CVE-2025-21574 PoC — Oracle MySQL Server 安全漏洞

介绍

# CVE-2025-21574-Exploit

#Key Features of this Black-Box Exploit:

1. Credential Brute-Forcing:
   - Tests 12+ common default username/password combinations
   - Checks 5 common system databases
   - Automatically detects valid credentials

2. Anonymous Access Attempt:
   - Tries connecting without any credentials
   - Tests all databases if anonymous access is enabled

3. Exploitation Phase:
   - Uses 150,000+ nesting levels for maximum impact
   - Automatically detects server crash symptoms
   - Tests all valid credential/database combinations

4. Error Handling:
   - Distinguishes between connection errors and successful crashes
   - Handles various MySQL error conditions gracefully

#Usage Instructions:
1. Replace `TARGET_IP` with your target server's IP address
2. Install prerequisites: `pip install pymysql`
3. Run the script: `python cve-2025-21574-exploit.py`

#Expected Outcomes:
- Success: "Exploit succeeded! MySQL server crashed."
- Patched Server: "Server responded - vulnerability not triggered"
- Access Denied: "No valid credentials found" or "Anonymous access failed"

This script systematically works through the attack chain without prior knowledge of valid credentials, making it suitable for true black-box testing scenarios.

文件快照

备注