Basamak DernekWeb stored cross-site scripting

#!/usr/bin/env bash
# check-dernekweb-cve-2026-7498.sh
# Safe fingerprint check for DernekWeb CVE-2026-7498
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage / network error

set -u

TARGET="${1:-}"
CUTOFF="30122025"
UA="Mozilla/5.0 (compatible; noisgate-check/1.0)"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://target.example.org"
  echo "UNKNOWN"
  exit 2
fi

if ! command -v curl >/dev/null 2>&1; then
  echo "curl is required"
  echo "UNKNOWN"
  exit 2
fi

TMP=$(mktemp -d 2>/dev/null || mktemp -d -t dernekwebcheck)
trap 'rm -rf "$TMP"' EXIT

fetch() {
  local url="$1"
  local out="$2"
  curl -k -L -A "$UA" --connect-timeout 10 --max-time 20 -fsS "$url" -o "$out"
}

BODY="$TMP/body.html"
HEADERS="$TMP/headers.txt"
if ! curl -k -L -A "$UA" --connect-timeout 10 --max-time 20 -fsS -D "$HEADERS" "$TARGET" -o "$BODY"; then
  echo "UNKNOWN"
  exit 2
fi

# Quick product identification
if ! grep -Eqi 'DernekWeb|basamak|dernek yazılımı|dernekweb' "$BODY"; then
  echo "UNKNOWN"
  exit 2
fi

# Look for explicit build/version/date markers in HTML/JS asset names or comments.
MATCH=$(grep -Eo '(20[0-9]{6}|[0-3][0-9][0-1][0-9]20[0-9]{2}|30122025|202[0-9][01][0-9][0-3][0-9])' "$BODY" | sort -u | tail -n 1 || true)

# Check linked assets for date-like cache busters
ASSETS=$(grep -Eoi '(src|href)="[^"]+"' "$BODY" | sed -E 's/^(src|href)="//; s/"$//' | head -n 20)
for a in $ASSETS; do
  if [[ "$a" =~ ^https?:// ]]; then
    url="$a"
  elif [[ "$a" =~ ^/ ]]; then
    url="${TARGET%/}$a"
  else
    url="${TARGET%/}/$a"
  fi
  echo "$url" >> "$TMP/asset-urls.txt"
done

if [[ -s "$TMP/asset-urls.txt" ]]; then
  while IFS= read -r url; do
    if curl -k -L -A "$UA" --connect-timeout 10 --max-time 10 -fsS "$url" -o "$TMP/asset.tmp" 2>/dev/null; then
      CAND=$(grep -Eo '(20[0-9]{6}|[0-3][0-9][0-1][0-9]20[0-9]{2}|30122025|202[0-9][01][0-9][0-3][0-9])' "$TMP/asset.tmp" | sort -u | tail -n 1 || true)
      if [[ -n "$CAND" ]]; then
        MATCH="$CAND"
        break
      fi
    fi
  done < "$TMP/asset-urls.txt"
fi

# Best-effort classification
if [[ -n "$MATCH" ]]; then
  # Normalize YYYYMMDD-like values if present; otherwise compare raw strings conservatively.
  if [[ "$MATCH" =~ ^[0-3][0-9][0-1][0-9]20[0-9]{2}$ ]]; then
    if [[ "$MATCH" == "$CUTOFF" || "$MATCH" < "$CUTOFF" ]]; then
      echo "VULNERABLE"
      exit 1
    else
      echo "PATCHED"
      exit 0
    fi
  fi
fi

# Weak signal: CSP can reduce exploitability but does not prove patched.
if grep -Eqi '^content-security-policy:' "$HEADERS"; then
  echo "UNKNOWN"
  exit 2
fi

echo "UNKNOWN"
exit 2