CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE

Python 3 checker (and configurable exploit hook) for CVE-2026-90817 (Securifera / Ryan Wincey).

Summary

From a public survey context, attackers can abuse __passthru (survey passthrough) routing to reach unintended controllers (e.g. Data Import), then trigger unsafe file-path / stream handling → RCE.

Securifera has not published the full HTTP chain yet (no public PoC on GitHub / Exploit-DB at repo publish time).

exploit_chain.example.json is placeholder only (guessed routes/params). It will not RCE.
Research dry run: --allow-placeholder-chain (sends requests; expect failure).

Requirements

• Python 3.9+
• pip install -r requirements.txt

Usage

pip install -r requirements.txt

# Single target (survey hash required for survey + passthru tests)
python poc.py -u https://redcap.example.edu/redcap --hash Ab12Xy34Zq --mode check

# Shorthand: base|hash
python poc.py -u "https://redcap.example.edu/redcap|Ab12Xy34Zq" --mode check

# Mass check (one URL per line, optional |hash)
python poc.py --list targets.example.txt --mode check -j 20 -q

# Live stream: every host + test summary (recommended for long lists)
python poc.py --list targets.example.txt --mode check -j 20 -q --flow

# Exploit (after advisory → real exploit_chain.json)
cp exploit_chain.example.json exploit_chain.json   # edit with real values
python poc.py -u https://redcap.example.edu/redcap --hash XXX --mode exploit -c id \
  --chain exploit_chain.json

FOFA export → target list

# Place export as fofa_csv_7561.csv (or any fofa*.csv), then:
python fofa_to_list.py
# Writes list.txt (gitignored) and normalizes the CSV with a url column
python poc.py --list list.txt --mode check -j 20 -q --flow

Target list format

https://uni.edu/redcap|SurveyHash10
https://uni.edu/redcap?s=SurveyHash10
https://uni.edu/redcap

Without a hash, check can still fingerprint REDCap and flag version windows, but cannot validate survey or run passthru probes.

Screenshot (--flow mass check)

CLI options

Output (mass check)

Common status values (check)

Limitations

• Exploit requires exact __passthru route and parameter names from Securifera/vendor; defaults are placeholders.
• Many instances hide version strings; vulnerable_version may be null.
• FOFA title="REDCap" rows often lack survey hashes — CVE preconditions need s= from public links.
• Authorized testing only.

FOFA / discovery hints

title="REDCap"
body="redcap_version"
body="/surveys/?s="

Repository layout

.
├── poc.py
├── fofa_to_list.py
├── exploit_chain.example.json
├── poc.png                 # example --flow terminal output
├── requirements.txt
├── targets.example.txt
├── README.md
├── LICENSE
└── .gitignore

References

• NVD — CVE-2026-90817
• CVE Record
• Securifera advisories

Legal

For authorized security testing only. You are responsible for compliance with applicable laws and program rules.