Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-45346 — Proof-of-concept exploit for time-based blind SQL injection in Bacula-Web's jobfiles endpoint, using pg_sleep() delays to extract PostgreSQL version remotely. | Kitploit
Tools/GitHubGitHub/0xsu3ks/cve-2025-45346
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingDatabase Security
GitHub0xsu3ks/cve-2025-45346

CVE-2025-45346

Proof-of-concept exploit for time-based blind SQL injection in Bacula-Web's jobfiles endpoint, using pg_sleep() delays to extract PostgreSQL version remotely.

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-45346 – Bacula-Web Time-Based SQL Injection (PostgreSQL Version Extraction)

📝 Overview

Vulnerability Title: Time-Based Blind SQL Injection in Bacula-Web
Product: Bacula-Web
Versions Affected: Confirmed in versions supporting PostgreSQL backend
CVE ID: CVE-2025-45346
Severity: High
Attack Vector: Remote
Impact: Arbitrary SQL Execution, Information Disclosure

🧨 Description

This proof-of-concept (PoC) demonstrates a time-based blind SQL injection vulnerability in the jobfiles endpoint of Bacula-Web.
A remote attacker can leverage this flaw to extract information from the underlying PostgreSQL database — including the database version — by triggering deliberate delays using the pg_sleep() function.

🚀 Features

  • Confirms presence of SQL injection via time delay test
  • Automatically extracts PostgreSQL version character-by-character
  • Utilizes URL-encoded payloads for precision
  • Prints live progress during version extraction

    • 📌 Usage

    ⚙️ Requirements

    • Python 3.x
    • requests library (pip install requests)

    🔧 Configuration

    Edit the script and set:

    root@kitploit:~
    base_url = "http://baculaweb.domain/jobfiles/29/1/"
cookies = {"Bacula-Web": "REPLACEME"}

    Replace:

    • base_url with your Bacula-Web target URL
    • REPLACEME with your valid Bacula-Web session cookie

    🏃 Run the Script

    root@kitploit:~
    python3 extract_pgsql_version.py

    🧾 Exploit Workflow

    1. Sends a benign SQL payload with pg_sleep(2) to verify injection.
    2. If the server response takes ~2s, the script proceeds to extract the version.
    3. It loops through positions in the PostgreSQL version string using SUBSTRING() and compares characters one-by-one.
    4. Delay-based detection identifies the correct character.

    🔐 Impact

    • Exposes sensitive database information to remote attackers
    • May be leveraged to chain into further SQL-based exploitation
    • Undermines trust in the web interface for backup job visibility

    🛡️ Mitigation

    • Apply input validation on the jobfiles route
    • Use parameterized queries in backend logic
    • Upgrade Bacula-Web to the latest patched version (once available)

    👨‍💻 Discoverer

    Security Researcher – Kevin Suckiel -- 0xsu3ks PoC for CVE-2025-45346 disclosed via responsible disclosure.

    ⚠️ Legal Notice

    This tool is provided for authorized testing and research purposes only.
    The author is not responsible for any unauthorized use or misuse of this PoC.

    Download Tool