Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CVE-2025-6860 PoC — SourceCodester Best Salon Management System staff_commision.php sql injection

Source
Associated Vulnerability
Title:SourceCodester Best Salon Management System staff_commision.php sql injection (CVE-2025-6860)
Description:A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /panel/staff_commision.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Description
A proof‑of‑concept command‑line tool in C for detecting the SQL injection vulnerability .
Readme
# CVE-2025-6860 Exploit Tool

A proof‑of‑concept command‑line tool in C for detecting (and rudimentary exploiting) the SQL injection vulnerability **CVE‑2025‑6860** in `staff_commision.php` (parameters `fromdate` & `todate`). Leverages **libcurl** for HTTP requests, rotates through common payloads & user‑agents, scans responses for SQL error patterns, and emits colorful, syscall‑driven console output.

##  Features

- **Automatic payload rotation**  
  Tries a variety of SQL injection payloads (`' OR 1 -- -`, `admin' or '1'='1`, `-1 UNION SELECT 1`, …) against both `fromdate` and `todate`.

- **Dynamic User‑Agent cycling**  
  Rotates through a list of realistic browser UA strings to evade simple filters.

- **Libcurl‑powered HTTP**  
  Follows redirects, disables SSL verification (for testing), custom headers.

- **Low‑level syscalls for I/O**  
  Uses `syscall(write)` instead of `printf()` for colored & timely messaging.

- **Response analysis**  
  Scans server replies for 50+ SQL error signatures (MySQL, PostgreSQL, Oracle, MSSQL, OLE‑DB, ODBC, Hibernate, etc.).

- **ANSI‑colored output**  
  Clear success / failure / informational messages in green, blue, red.


##  Prerequisites

- **gcc** (or any recent C compiler with Linux x86_64 support)
- **libcurl** development headers
- **argparse.c/h** (bundled in this repo)

On Debian/Ubuntu:
sudo apt update
sudo apt install -y build-essential libcurl4-openssl-dev

## Build : 
gcc exploit.c argparse.c -o exploit -lcurl

## Usage :
./exploit -u "http://target.com/panel/staff_commision.php?fromdate=&todate="
-u, --url
Target URL template, include the base path and empty parameters.

Example :
./exploit -u "http://vulnweb.com/panel/staff_commision.php?fromdate=&todate="
If vulnerable, you’ll see:

[+] Exploitation of CVE-2025-6860 has begun...
[+] TARGET URL   : http://…?fromdate=&todate=
[+] Request sent successfully!
[+] FULL URL     : http://…?fromdate=' OR 1 -- -&todate=' OR 1 -- -
[+] HTTP CODE    : 200
[+] A suspicious word was found in response!
[+] Keyword      : You have an error in your SQL syntax
[+] The server suffers from a CVE-2025-6860 vulnerability!
On failure, it reports missing patterns or HTTP errors.

📂 File Structure :
├── exploit.c       # Main exploit logic
├── argparse.c      # Minimal argparse implementation
├── argparse.h      # Header for argparse.c
├── README.md       # This documentation
└── LICENSE         # MIT License file
📝 Contribute :
Fork the repo

Add payloads / error patterns / advanced extraction features

Disclaimer: Use this tool only on systems you own or have explicit permission to test. Unauthorized scanning or exploitation is illegal.

File Snapshot

Log in to view the POC file snapshot cached by Shenlong Bot

Log in to view
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →