Akmer Bilişim parking/access automation authorization bypass through user-controlled SQL primary key

#!/usr/bin/env python3
# check_cve_2026_4104.py
# Purpose: lightweight external fingerprint for Akmer/TeknoPass exposure and visible versioning.
# This does NOT exploit the target. It reports VULNERABLE / PATCHED / UNKNOWN based on visible product markers
# and optionally a defender-supplied fixed version string.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/network error

import argparse
import re
import sys
from urllib.parse import urljoin

try:
    import requests
except Exception:
    print('UNKNOWN - missing dependency: requests')
    sys.exit(2)

PRODUCT_MARKERS = [
    r'Akmer',
    r'Akmer\s*Bili',
    r'TeknoPass',
    r'otopark',
    r'access\s*control',
    r'parking\s*automation',
]

VERSION_PATTERNS = [
    r'version\s*[:=]\s*([0-9][0-9A-Za-z._\-]+)',
    r'build\s*[:=]\s*([0-9][0-9A-Za-z._\-]+)',
    r'v([0-9]+(?:\.[0-9A-Za-z_\-]+)+)',
]

COMMON_PATHS = [
    '/',
    '/login',
    '/admin',
    '/api',
    '/swagger',
    '/docs',
]


def normalize(v):
    return re.sub(r'[^0-9A-Za-z]+', '.', v).strip('.').lower()


def looks_like_product(text):
    for pat in PRODUCT_MARKERS:
        if re.search(pat, text, re.IGNORECASE):
            return True
    return False


def extract_version(text):
    for pat in VERSION_PATTERNS:
        m = re.search(pat, text, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def fetch(session, base, path):
    url = urljoin(base.rstrip('/') + '/', path.lstrip('/'))
    try:
        r = session.get(url, timeout=10, allow_redirects=True, verify=True)
        return url, r.status_code, r.text[:500000]
    except requests.RequestException:
        return url, None, ''


def main():
    ap = argparse.ArgumentParser(description='Non-intrusive Akmer/TeknoPass exposure/version check for CVE-2026-4104')
    ap.add_argument('base_url', help='Base URL, e.g. https://parking.example.com')
    ap.add_argument('--fixed-version', help='Known fixed version/build from vendor advisory, if available')
    args = ap.parse_args()

    session = requests.Session()
    session.headers.update({'User-Agent': 'noisgate-cve-2026-4104-check/1.0'})

    product_seen = False
    discovered_version = None
    reachable = False
    seen_urls = []

    for path in COMMON_PATHS:
        url, status, text = fetch(session, args.base_url, path)
        seen_urls.append((url, status))
        if status is not None:
            reachable = True
        if not text:
            continue
        if looks_like_product(text):
            product_seen = True
        if discovered_version is None:
            discovered_version = extract_version(text)

    if not reachable:
        print('UNKNOWN - target not reachable from this workstation')
        sys.exit(3)

    if not product_seen:
        print('UNKNOWN - no visible Akmer/TeknoPass markers detected on common paths')
        sys.exit(2)

    if args.fixed_version and discovered_version:
        if normalize(discovered_version) == normalize(args.fixed_version):
            print(f'PATCHED - product marker found and visible version/build matches supplied fixed version: {discovered_version}')
            sys.exit(0)
        else:
            print(f'VULNERABLE - product marker found and visible version/build ({discovered_version}) does not match supplied fixed version ({args.fixed_version})')
            sys.exit(1)

    if discovered_version and not args.fixed_version:
        print(f'UNKNOWN - Akmer/TeknoPass marker found; visible version/build discovered: {discovered_version}; compare manually to vendor fixed build once published')
        sys.exit(2)

    print('UNKNOWN - Akmer/TeknoPass marker found but no trustworthy version/build string exposed; use authenticated inventory or vendor advisory to confirm patch state')
    sys.exit(2)


if __name__ == '__main__':
    main()