CVE-2025-8971 (SQL Injection)

Author: Byte Reaper

Description :

This exploit for CVE-2025-8971, a SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0. The vulnerability exists in /admin/operations/travellers.php and can be exploited remotely via the val-username parameter.

How It Works

The exploit sends crafted HTTP POST requests to the target URL.

Payloads are encoded and injected into val-username.

Optional file upload (.php or image) can be used to achieve remote code execution.

The script verifies responses to check if the payload was successfully executed.

Requirements :

GCC compiler (gcc)

Linux x86_64 

ibcurl 

Compilation :

    gcc script.c argparse.c -o CVE-2025-8971 -lcurl
    ./CVE-2025-8971 -u http://<target> -v [verbose mode]

Usage:

    -h, --help            help message 
    -u, --url             Target Url (BASE URL)
    -c, --cookies         File cookies
    -i, --ip              Fake Ip (Host request)
    -f, --file            File upload (.php / image)
    -v, --verbose         Verbose Mode