์—…๋ฐ์ดํŠธ๋กœ ๋Œ์•„๊ฐ€๊ธฐ
UpdatedAug 3, 2026

CVE-PoC-Hub โ€” Updated!

๐Ÿ›ก๏ธ CVE ๊ฐœ๋… ์ฆ๋ช… ํ—ˆ๋ธŒ โ€” ๊ณต๊ฐœ๋œ CVE 4๊ฑด ยท ๊ฒ€ํ†  ์ค‘ 5๊ฑด (VulnCheck) ยท SuiteCRM ์ผ๊ด„ ์ฒ ํšŒ

๊ณต์œ 

๐Ÿ”ฌ CVE-PoC-Hub โ€” ๊ฒ€์ฆ๋œ ๊ฐœ๋… ์ฆ๋ช… ์ต์Šคํ”Œ๋กœ์ž‡ ๋ชจ์Œ

์ตœ์‹  CVE์— ๋Œ€ํ•œ ์ž‘๋™ํ•˜๊ณ  ๊ฒ€์ฆ๋œ PoC ์Šคํฌ๋ฆฝํŠธ. ์‹คํ—˜์‹ค ํ™˜๊ฒฝ์—์„œ ํ…Œ์ŠคํŠธ๋จ. ๋ณด์•ˆ ์—ฐ๊ตฌ์›, ์นจํˆฌ ํ…Œ์Šคํ„ฐ, CTF ํ”Œ๋ ˆ์ด์–ด๋ฅผ ์œ„ํ•œ ์ž๋ฃŒ.


โš ๏ธ ๋ฉด์ฑ… ์กฐํ•ญ

๋ชจ๋“  PoC๋Š” ๊ต์œก ๋ฐ ์Šน์ธ๋œ ํ…Œ์ŠคํŠธ ๋ชฉ์ ์œผ๋กœ๋งŒ ์ œ๊ณต๋ฉ๋‹ˆ๋‹ค. ๊ฐ ์ต์Šคํ”Œ๋กœ์ž‡์€ ๊ฒฉ๋ฆฌ๋œ ์‹คํ—˜์‹ค ํ™˜๊ฒฝ์—์„œ ํ…Œ์ŠคํŠธ๋˜์—ˆ์Šต๋‹ˆ๋‹ค. ๋ช…์‹œ์  ํ—ˆ๊ฐ€ ์—†์ด ์‹œ์Šคํ…œ์— ์‚ฌ์šฉํ•˜์ง€ ๋งˆ์‹ญ์‹œ์˜ค.


๐Ÿ“‚ ์ €์žฅ์†Œ ๊ตฌ์กฐ

CVE-PoC-Hub/
โ”œโ”€โ”€ README.md
โ”œโ”€โ”€ CVE-2026-XXXXX/           # ๊ฐ CVE๋Š” ์ž์ฒด ํด๋”๋ฅผ ๊ฐ€์ง
โ”‚   โ”œโ”€โ”€ README.md              # ์„ค๋ช… + ์ ˆ์ฐจ
โ”‚   โ”œโ”€โ”€ exploit.py             # ์ž‘๋™ํ•˜๋Š” PoC
โ”‚   โ””โ”€โ”€ screenshot.png         # ์ต์Šคํ”Œ๋กœ์ž‡ ์ฆ๋ช…
โ”œโ”€โ”€ templates/
โ”‚   โ””โ”€โ”€ poc-template.py        # ํ‘œ์ค€ PoC ํ…œํ”Œ๋ฆฟ
โ””โ”€โ”€ poc-runner.py              # ๋Œ€๋Ÿ‰ PoC ์‹คํ–‰๊ธฐ

๐Ÿ”ฅ CVE (2026)

โœ… ๊ฒŒ์‹œ๋จ

CVE์ œํ’ˆ์œ ํ˜•CVSS
CVE-2026-66412Leantime โญ10k+IDOR (getMilestone)7.5
CVE-2026-66414Leantime โญ10k+์˜คํ”ˆ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ6.1
CVE-2026-66415Leantime โญ10k+SSRF + LFI8.8
CVE-2026-66416Leantime โญ10k+CSRF ๋น„ํ™œ์„ฑํ™”8.8

โณ ๊ณต๊ธ‰์—…์ฒด / GitHub ๊ฒ€ํ†  ์ค‘

ID๋Œ€์ƒ์œ ํ˜•CVSS์ƒํƒœ
b5aa1a1aOzonTech file.d์ธ์ฆ ์—†๋Š” ๊ด€๋ฆฌ API (:9000)8.2โœ… 2026-08-13 ์‹ค์‹œ๊ฐ„ ๊ฒ€์ฆ โ€” ๋ฐฉ์–ด ์ค‘
๐Ÿ—‘๏ธ ์ฒ ํšŒ๋จ โ€” SuiteCRM ๋ฐฐ์น˜ + VulnCheck ๋ฐฐ์น˜ (8๊ฑด, 2026-08-13 ์‹ค์‹œ๊ฐ„ ํ…Œ์ŠคํŠธ)

SuiteCRM:

ID์œ ํ˜•CVSS์ฒ ํšŒ ์‚ฌ์œ 
SCRMBT-480์ธ์ฆ ์—†๋Š” SQLi (GeneratePassword)9.8retrieve_user_id()์—์„œ ํŽ˜์ด๋กœ๋“œ๊ฐ€ ์ด์Šค์ผ€์ดํ”„๋จ; INSERT ๋„๋‹ฌ ๋ถˆ๊ฐ€ (MySQL ์ผ๋ฐ˜ ๋กœ๊ทธ)
SCRMBT-481ํŒŒ์ผ ์—…๋กœ๋“œ Case ์šฐํšŒ8.82020๋…„๋ถ€ํ„ฐ strtolower() ์ ์šฉ๋จ; ํŒŒ์ผ์€ GUID ์ด๋ฆ„์œผ๋กœ ์ €์žฅ๋จ
SCRMBT-482ํŒŒ์ผ ์—…๋กœ๋“œ GD ์šฐํšŒ RCE8.8์ฝ˜ํ…์ธ  ์ •๊ทœ์‹์ด GD ๊ฒ€์‚ฌ๋ณด๋‹ค ๋จผ์ € ์‹คํ–‰๋จ; 7.11.x๋ถ€ํ„ฐ GD ๋ˆ„๋ฝ ์‹œ false ๋ฐ˜ํ™˜
SCRMBT-483์ธ์ฆ ์—†๋Š” XSS (WebToLead)8.2voku AntiXSS๊ฐ€ ์—”ํ‹ฐํ‹ฐ ๋‚œ๋…ํ™”๋œ on* / javascript:๋„ ์ œ๊ฑฐํ•จ

VulnCheck:

ID๋Œ€์ƒ์œ ํ˜•CVSS์ฒ ํšŒ ์‚ฌ์œ 
ad927f12eGov SmartCityStruts2 RCE10.0S2-045/046๋Š” 2.5.14.1์— ์ ์šฉ๋˜์ง€ ์•Š์Œ; S2-057 = ๊ธฐ์กด CVE-2018-11776 (CNA ๊ทœ์น™์ƒ ์žฌ์ง€์ • ๊ธˆ์ง€)
55c37649Tesla Vehicle CMDJWT ๊ฒ€์ฆ ์—†์Œ8.8์„ค๊ณ„์ƒ ์˜๋„๋จ: ํ”„๋ก์‹œ๊ฐ€ ํ† ํฐ์„ ๊ฒ€์ฆํ•˜๋Š” Tesla ์ฐจ๋Ÿ‰ API๋กœ ์ค‘๊ณ„ โ€” ์œ„์กฐ ํ† ํฐ โ†’ 401
9582b653Gojek Darkroom๊ฒฝ๋กœ ํƒ์ƒ‰7.5gorilla/mux cleanPath๊ฐ€ ๋””์ŠคํŒจ์น˜ ์ „์— ๋ชจ๋“  ../๋ฅผ 301 ๋ฆฌ๋‹ค์ด๋ ‰ํŠธํ•จ (์‹ค์‹œ๊ฐ„ ํ…Œ์ŠคํŠธ)
97d14382Kaspersky KLara์†๋„ ์ œํ•œ ์—†์Œ6.5๋ณด์•ˆ ๊ฐ•ํ™” ๊ฒฉ์ฐจ๋กœ CVE ๊ธฐ์ค€ ๋ฏธ๋‹ฌ; ๋ณด๊ณ ์„œ์— ์ž˜๋ชป๋œ ํ”„๋ ˆ์ž„์›Œํฌ ๋ช…์‹œ๋จ

VulnCheck CNA(Khushali Dalal)๋ฅผ ํ†ตํ•ด CVE 4๊ฑด ๊ฒŒ์‹œ๋จ. file.d๋Š” ์‹ค์‹œ๊ฐ„ ๊ฒ€์ฆ ์™„๋ฃŒ ๋ฐ ๋ฐฉ์–ด ์ค‘. ์‹ค์‹œ๊ฐ„ ์žฌํ…Œ์ŠคํŠธ ํ›„ 8๊ฑด์˜ ๋ฐœ๊ฒฌ ์‚ฌํ•ญ์„ ์ •์งํ•˜๊ฒŒ ์ฒ ํšŒํ•จ.

๐Ÿš€ ๋น ๋ฅธ ์‹œ์ž‘

git clone https://github.com/javokhir-sec/CVE-PoC-Hub.git
cd CVE-PoC-Hub

# ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•œ ๋ชจ๋“  PoC ๋‚˜์—ด
python poc-runner.py --list

# ํŠน์ • PoC ์‹คํ–‰ (์‹คํ—˜์‹ค ํ™˜๊ฒฝ์—์„œ)
python poc-runner.py --cve CVE-2026-XXXXX --target http://lab-target.local

๐Ÿ“‹ PoC ํ…œํ”Œ๋ฆฟ

์ž์ฒด PoC์— ์ด ํ…œํ”Œ๋ฆฟ์„ ์‚ฌ์šฉํ•˜์„ธ์š”: templates/poc-template.py

#!/usr/bin/env python3
"""
CVE-YYYY-XXXXX: [Vulnerability Type] in [Product]
CVSS: X.X | Severity: Critical/High/Medium/Low
Author: @javokhir-sec
"""

import requests
import sys

TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://localhost"

def exploit(target):
    """Execute the exploit and return True if vulnerable."""
    print(f"[*] Testing {target} for CVE-YYYY-XXXXX")

    # Step 1: Send malicious request
    payload = "<script>alert(1)</script>"
    r = requests.get(f"{target}/search?q={payload}")

    # Step 2: Verify exploitation
    if payload in r.text:
        print(f"[+] VULNERABLE! Payload reflected in response.")
        return True
    else:
        print(f"[-] Not vulnerable.")
        return False

if __name__ == "__main__":
    exploit(TARGET)

๐Ÿ› ๏ธ ๋Œ€๋Ÿ‰ PoC ์‹คํ–‰๊ธฐ

# ๋Œ€์ƒ์— ๋Œ€ํ•ด ๋ชจ๋“  XSS PoC ์‹คํ–‰
python poc-runner.py --category xss --target http://lab.local

# ๋ชจ๋“  SQLi PoC ์‹คํ–‰
python poc-runner.py --category sqli --target http://lab.local

# ํŠน์ • ์‹ฌ๊ฐ๋„ ์ˆ˜์ค€ ์‹คํ–‰
python poc-runner.py --severity critical --target http://lab.local

๐Ÿ“Š ํ†ต๊ณ„

์นดํ…Œ๊ณ ๋ฆฌ๊ฐœ์ˆ˜
SQL ์ธ์ ์…˜4
XSS (๋ฐ˜์‚ฌํ˜•/์ €์žฅํ˜•)4
์ทจ์•ฝํ•œ ์ ‘๊ทผ ์ œ์–ด3
CSRF1
IDOR1
์ธ์ฆ ์šฐํšŒ2
SSRF + LFI1
ํŒŒ์ผ ์—…๋กœ๋“œ RCE1
์˜คํ”ˆ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ1
์ธ์ฆ ๋ˆ„๋ฝ1
์ด๊ณ„4 ๊ฒŒ์‹œ๋จ + 1 ํ™œ์„ฑ (file.d, ๊ฒ€์ฆ๋จ)

๐Ÿค ๊ธฐ์—ฌํ•˜๊ธฐ

์ตœ์‹  CVE์— ๋Œ€ํ•œ ์ž‘๋™ํ•˜๋Š” PoC๊ฐ€ ์žˆ์œผ์‹ ๊ฐ€์š”?

  1. ์ด ์ €์žฅ์†Œ๋ฅผ ํฌํฌํ•˜์„ธ์š”
  2. ํด๋” ์ƒ์„ฑ: CVE-YYYY-XXXXX/
  3. ํฌํ•จ ํ•ญ๋ชฉ: README.md + exploit.py + ์Šคํฌ๋ฆฐ์ƒท
  4. PR ์ œ์ถœ

๐Ÿ“œ ๋ผ์ด์„ ์Šค

MIT ยฉ Javokhir Tursunboyev

์นดํ…Œ๊ณ ๋ฆฌ