Unauthenticated SQL Injection in Metabase Password Reset API

This five-file repository contains an operational Python proof of concept and a self-contained Docker laboratory for the claimed CVE-2026-72898 Metabase password-reset SQL injection. metabase_exploit.py is the primary entry point: it POSTs a JSON user-id object with a raw SQL fragment to /api/session/reset_password, ignores the expected HTTP 400 response, and uses response latency as a PostgreSQL pg_sleep-based blind SQL oracle. It randomizes X-Forwarded-For for every request to evade a per-source reset-password throttle where the deployment trusts that header. The extractor supports a check-only mode, custom scalar SQL expressions, configurable delay, and optional disabled TLS verification; its default expression reads the earliest core_user email. The supporting Dockerfile, start.sh, and setup_bg.sh construct a reproducible vulnerable environment using metabase/metabase:v0.62.1 and a localhost PostgreSQL application database. start.sh initializes PostgreSQL, creates the mb role and metabase database, and launches Metabase. setup_bg.sh polls the local session-properties endpoint, retrieves the setup token, and invokes /api/setup to create a randomized-password admin account (admin@lab.local), ensuring the container reaches the login state. The README documents affected and patched version ranges, container startup, extraction examples, and mitigation guidance. No external command-and-control or hard-coded remote attacker infrastructure is present; the only remote target is operator supplied.

Repository contains two files: a README and a single Python exploit script, cve-2026-72898_poc.py. The script is a standalone operational PoC for CVE-2026-72898, an unauthenticated SQL injection in Metabase's password-reset workflow. It is not part of a larger exploit framework. Exploit flow is three-step: (1) GET the target root path / and require HTTP 200, (2) POST crafted JSON to /api/session/reset_password with a malicious user-id.select.raw value containing SQL that inserts a forged admin session row into core_session using a generated UUID and its SHA-256 hash, and (3) send the forged session via X-Metabase-Session to /api/user/current to verify administrator access. If the final request returns HTTP 200 with JSON, the script marks the target vulnerable and prints the forged session ID and admin email. The exploit's main capability is admin takeover without credentials. It does not deploy a shell or arbitrary post-exploitation payload; instead it creates an authenticated Metabase superuser session that can be reused in the browser through the metabase.SESSION cookie. The README documents both single-target and mass-target usage, expected response patterns, and manual browser steps for converting the forged session into full UI access. Code structure is simple: helper functions for colored output, session creation, SQLi body construction, target checking, and CLI parsing. It supports reading targets from a file, configurable timeout, and optional TSV output. The payload is hardcoded and purpose-built for session forgery, making the repository an operational exploit rather than a mere detector.

This repository is a minimal proof-of-concept exploit consisting of a short README and a single Bash script, poc.sh. The script uses curl to send an HTTP POST request to a local web application's password reset endpoint at /api/session/reset_password. The JSON body includes a token, a replacement password, and a nested user-id.raw field containing the SQL injection string "1) OR 1=1 -- ". The apparent goal is to exploit insufficient input sanitization in backend password reset logic, likely causing the reset operation to match unintended users or bypass intended constraints. The exploit is operational but basic: it contains a hardcoded target URL, hardcoded password, and hardcoded injection payload, with no automation, validation, or framework integration. The README provides no meaningful technical guidance.