CVE-2026-39349 OrangeHRM信息泄露漏洞

from Crypto.Cipher import AES from Crypto.Util.Padding import pad import binascii # Simulating the vulnerable encryption mechanism in OrangeHRM # In a real scenario, the key would be extracted from the configuration key = b'0123456789ABCDEF' # 16 bytes key for AES-128 cipher = AES.new(key, AES.MODE_ECB) # Example 1: Encrypting a sensitive field (e.g., Salary: 5000) data_1 = "Salary: 5000" ct1 = cipher.encrypt(pad(data_1.encode(), AES.block_size)) # Example 2: Encrypting the same field again data_2 = "Salary: 5000" ct2 = cipher.encrypt(pad(data_2.encode(), AES.block_size)) # Example 3: Encrypting a different field (e.g., Salary: 6000) data_3 = "Salary: 6000" ct3 = cipher.encrypt(pad(data_3.encode(), AES.block_size)) print(f"Ciphertext 1 (Salary 5000): {binascii.hexlify(ct1).decode()}") print(f"Ciphertext 2 (Salary 5000): {binascii.hexlify(ct2).decode()}") print(f"Ciphertext 3 (Salary 6000): {binascii.hexlify(ct3).decode()}") # Proof of Concept: ECB Mode Pattern Disclosure if ct1 == ct2: print("\n[!] Vulnerability Confirmed: Identical plaintexts produce identical ciphertexts (Pattern Disclosure).") else: print("\n[+] Safe: Ciphertexts differ.") # Analysis: An attacker seeing ct1 and ct2 in the database knows the values are identical # without knowing the actual key.