Landray EIS 2001 through 2006

# Test-Landray-CVE-2025-22214.ps1

# Purpose: Safe verification for potential SQLi behavior on Landray EIS Message/fi_message_receiver.aspx?replyid=

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


param(
    [Parameter(Mandatory=$true)]
    [string]$BaseUrl,

    [Parameter(Mandatory=$false)]
    [string]$Cookie = "",

    [Parameter(Mandatory=$false)]
    [int]$TimeoutSec = 20
)

$ErrorActionPreference = 'Stop'

function Invoke-Probe {
    param(
        [string]$Url,
        [string]$CookieHeader,
        [int]$Timeout
    )

    $headers = @{}
    if ($CookieHeader -and $CookieHeader.Trim().Length -gt 0) {
        $headers['Cookie'] = $CookieHeader
    }

    try {
        $resp = Invoke-WebRequest -Uri $Url -Method GET -Headers $headers -MaximumRedirection 3 -TimeoutSec $Timeout -UseBasicParsing
        return [pscustomobject]@{
            Ok = $true
            StatusCode = [int]$resp.StatusCode
            Content = [string]$resp.Content
            FinalUrl = [string]$resp.BaseResponse.ResponseUri.AbsoluteUri
        }
    }
    catch {
        $status = $null
        $content = ""
        $finalUrl = ""

        if ($_.Exception.Response) {
            try {
                $status = [int]$_.Exception.Response.StatusCode
            } catch {}
            try {
                $reader = New-Object System.IO.StreamReader($_.Exception.Response.GetResponseStream())
                $content = $reader.ReadToEnd()
                $reader.Close()
            } catch {}
            try {
                $finalUrl = [string]$_.Exception.Response.ResponseUri.AbsoluteUri
            } catch {}
        }

        return [pscustomobject]@{
            Ok = $false
            StatusCode = $status
            Content = [string]$content
            FinalUrl = [string]$finalUrl
        }
    }
}

function Has-SqlError {
    param([string]$Text)

    if (-not $Text) { return $false }

    $patterns = @(
        'sql syntax',
        'odbc',
        'oledb',
        'unclosed quotation mark',
        'incorrect syntax near',
        'sqlserver',
        'mysql',
        'native client',
        'exception of type',
        'database error',
        'system\.data\.sqlclient'
    )

    foreach ($p in $patterns) {
        if ($Text -match $p) { return $true }
    }
    return $false
}

try {
    $base = $BaseUrl.TrimEnd('/')
    $endpoint = "$base/Message/fi_message_receiver.aspx"

    # Benign baseline and quote probe. We do NOT use stacked queries or destructive payloads.

    $baselineUrl = "$endpoint?replyid=1"
    $probeUrl = "$endpoint?replyid=1'"

    $baseline = Invoke-Probe -Url $baselineUrl -CookieHeader $Cookie -Timeout $TimeoutSec
    $probe = Invoke-Probe -Url $probeUrl -CookieHeader $Cookie -Timeout $TimeoutSec

    $combined = (($baseline.Content | Out-String) + "`n" + ($probe.Content | Out-String)).ToLowerInvariant()
    $loginIndicators = @('login', 'signin', 'logon', 'passport', 'sso', 'authentication required')
    $looksLikeLogin = $false
    foreach ($li in $loginIndicators) {
        if ($combined -match $li) { $looksLikeLogin = $true; break }
    }

    # UNKNOWN conditions

    if (($baseline.StatusCode -eq 404) -and ($probe.StatusCode -eq 404)) {
        Write-Output 'UNKNOWN'
        exit 2
    }

    if ($looksLikeLogin -and (-not $Cookie -or $Cookie.Trim().Length -eq 0)) {
        Write-Output 'UNKNOWN'
        exit 2
    }

    # Positive signal: quote probe creates SQL error behavior not seen in baseline

    $baselineHasSql = Has-SqlError -Text $baseline.Content.ToLowerInvariant()
    $probeHasSql = Has-SqlError -Text $probe.Content.ToLowerInvariant()

    if (($probeHasSql -and -not $baselineHasSql) -or (($probe.StatusCode -ge 500) -and ($baseline.StatusCode -lt 500))) {
        Write-Output 'VULNERABLE'
        exit 1
    }

    # If endpoint exists and quote probe does not trigger obvious error deltas, treat as PATCHED/NOT EVIDENT

    if (($baseline.StatusCode -in 200,302,401,403,500) -or ($probe.StatusCode -in 200,302,401,403,500)) {
        Write-Output 'PATCHED'
        exit 0
    }

    Write-Output 'UNKNOWN'
    exit 2
}
catch {
    Write-Error $_.Exception.Message
    Write-Output 'UNKNOWN'
    exit 3
}