lan1oc/cve-2026-5147-expExploit script for CVE-2026-5147, performing boolean and time-based blind SQL injection against MySQL interfaces to extract version, database, schema, and data. Includes calibration, dump subcommands, and configurable payloads.
For authorized vulnerability validation and lab practice: performs MySQL boolean-based blind injection (EXP / INSTR or ASCII) and time-based blind injection (if + ascii + sleep) against SQL injection endpoints, with optional extraction of version, database name, table structure, and data (behavior similar to sqlmap's --dump).
Do not use against unauthorized systems.
pip install requests
CURRENT_USER + INSTR probes to the injection point, using the business field in the response JSON (default code) to distinguish between "true / false" branches.-p instr or ascii).--skip-calibrate: skips the above calibration; still guesses using boolean + JSON fields, without automatic switching to time-based (suitable for local debugging).The JSON field name and value used to determine "true" can be adjusted via --json-code-field and --json-code-true (must match the target API).
# Domain only: appended to the default path (see DEFAULT_API_PATH in the script)
python cve-2026-5147.py -u target.example.com
# Specify HTTPS, custom path, and injection parameter name
python cve-2026-5147.py -u target.example.com --https --path /api/foo --param id
# Full database dump (extremely high request volume, use with caution)
python cve-2026-5147.py -u target.example.com dump
# Only pull table name strings, no data export
python cve-2026-5147.py -u target.example.com dump --schema-only
Progress and diagnostic information go to stderr, final summary goes to stdout.
| Parameter | Description |
|---|---|
-u / --url | Target (domain, host:port, or full URL), required |
--path | Path appended to the host when no path is provided (default tenant-style API path) |
--https | Use https when no scheme is provided (defaults to http://) |
--param | Injection parameter name (default website) |
-p / --payload | Boolean fragment: instr or ascii (time-based injection is fixed to if+ascii+sleep) |
--timeout | HTTP timeout (seconds); automatically set to no less than sleep+5 when entering time-based injection |
--sleep | sleep() seconds for time-based injection |
--time-floor | True condition: total elapsed time ≥ this value (seconds); default approximately sleep - 1 |
--json-code-field / --json-code-true | JSON field read for the boolean side channel and its "true" value |
--skip-calibrate | Skip probe calibration |
--only | version / database / both: only pull version, only pull database name, or both |
-H / -P | Additional request headers, extra query parameters; can be repeated |
The dump subcommand also supports --schema-only, --dump-out, --dump-row-limit, --dump-select, etc. See python cve-2026-5147.py -h.
| Subcommand | Meaning |
|---|---|
info (default) | Pulls VERSION(), current database name DATABASE() (affected by --only) |
dump | Additionally pulls current database table names, per-table column names, and row data (or schema only, see --schema-only) |
main() first calls calibrate_sqli_oracle; on failure, sets effective_detect = "time" and calls bind_time_payload; in time mode, calls calibrate_time_oracle.--json-code-field (no longer hardcoded to code).command has been corrected so the default subcommand is info, not dump.This script is intended for security research and authorized testing only. Users are responsible for ensuring compliance with local laws and the authorization scope of the target environment.